|
Log-Analyse und Auswertung: Bildschirm friert ein aber Mauscursor bewegt sich, alles nach Inkassomail-AnhangWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
14.08.2013, 15:12 | #16 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Bildschirm friert ein aber Mauscursor bewegt sich, alles nach Inkassomail-Anhang Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
14.08.2013, 16:40 | #17 |
| Bildschirm friert ein aber Mauscursor bewegt sich, alles nach Inkassomail-AnhangFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-08-2013 01 Ran by Peter (administrator) on 14-08-2013 17:37:12 Running from C:\Users\Peter\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AVG Technologies CZ, s.r.o.) D:\AVGANT~1\avgrsa.exe (AVG Technologies CZ, s.r.o.) D:\AVG antivirus\avgcsrva.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (AVG Technologies CZ, s.r.o.) D:\AVG antivirus\avgidsagent.exe (AVG Technologies CZ, s.r.o.) D:\AVG antivirus\avgwdsvc.exe (MSI) C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (AVG Technologies CZ, s.r.o.) D:\AVG antivirus\avgui.exe (AVG Technologies CZ, s.r.o.) D:\AVG antivirus\avgnsa.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-07-27] (NVIDIA Corporation) HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-27] (Realtek Semiconductor) MountPoints2: {a3c44cb5-9d57-11e1-8455-806e6f6e6963} - E:\SETUP.EXE MountPoints2: {c3bcec92-bba0-11e2-b80c-8c89a584d284} - H:\Startme.exe HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [Super-Charger] - C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe [506864 2013-03-08] (MSI) HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811800 2010-10-05] (Logitech(c)) HKLM-x32\...\Run: [AVG_UI] - D:\AVG antivirus\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [Live Update 5] - C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [315392 2012-01-30] () HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-06-27] (1und1 Mail und Media GmbH) AppInit_DLLs: C:\PROGRA~3\NVIDIA~1\NVSTRE~1\rxinput.dll C:\PROGRA~3\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] (NVIDIA Corporation) AppInit_DLLs-x32: C:\PROGRA~3\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] (NVIDIA Corporation) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== ProxyServer: :0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKCU - {791F4938-1F53-42E2-8FAA-1ED9EA04E04B} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms} SearchScopes: HKCU - {AE6FBC7C-6110-4BD7-8F32-BA4998324B08} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie SearchScopes: HKCU - {D90FC07B-B601-4E85-8ECE-CB3055E233E4} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms} SearchScopes: HKCU - {FDC17D6D-15AC-446B-A323-4B107C64527D} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms} BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH) BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH) Toolbar: HKLM-x32 - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH) Toolbar: HKCU - WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~3\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default FF NetworkProxy: "no_proxies_on", "127.0.0.1" FF NetworkProxy: "socks", "127.0.0.1" FF NetworkProxy: "socks_port", 9050 FF NetworkProxy: "socks_remote_dns", true FF NetworkProxy: "type", 4 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=1.132.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll (ESN Social Software AB) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll () FF SearchPlugin: C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\searchplugins\webde-suche.xml FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\Extensions\ich@maltegoetz.de FF Extension: toolbar - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\Extensions\toolbar@web.de.xpi FF Extension: No Name - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi FF Extension: No Name - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ==================== Services (Whitelisted) ================= R2 AVGIDSAgent; D:\AVG antivirus\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.) R2 avgwd; D:\AVG antivirus\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.) R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [161264 2013-02-20] (MSI) R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-03-26] (Nitro PDF Software) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14984480 2013-07-27] (NVIDIA Corporation) S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-02-03] () S3 DAUpdaterSvc; C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [x] ==================== Drivers (Whitelisted) ==================== R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-07-10] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.) R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech) R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech) R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI) R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI) S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI) S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39712 2013-05-14] (NVIDIA Corporation) S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [22016 2012-11-07] (Razer USA Ltd) S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-14 17:25 - 2013-08-14 17:25 - 00000000 ____D C:\Windows\ERUNT 2013-08-14 17:24 - 2013-08-14 17:24 - 00004279 _____ C:\Users\Peter\Desktop\AdwCleaner[0].txt 2013-08-14 17:20 - 2013-08-14 17:22 - 00000000 ____D C:\AdwCleaner 2013-08-14 16:30 - 2013-08-14 16:30 - 01158897 _____ (Thisisu) C:\Users\Peter\Desktop\JRT.exe 2013-08-14 16:30 - 2013-08-14 16:30 - 00800594 _____ C:\Users\Peter\Desktop\adwcleaner.exe 2013-08-14 14:38 - 2013-08-14 14:38 - 01575570 _____ (Farbar) C:\Users\Peter\Desktop\FRST64.exe 2013-08-14 11:34 - 2013-08-14 11:34 - 00003878 _____ C:\Windows\System32\Tasks\Registration 1und1 Task 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\ProgramData\UUdb 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\ProgramData\1&1 Mail & Media GmbH 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\Program Files\WEB.DE MailCheck 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\Program Files (x86)\1und1Softwareaktualisierung 2013-08-14 10:52 - 2013-08-14 10:52 - 00052146 _____ C:\Users\Peter\Desktop\bookmarks.html 2013-08-14 10:50 - 2013-08-14 10:50 - 00027896 _____ C:\Users\Peter\Desktop\bookmarks-2013-08-14.json 2013-08-14 07:19 - 2013-08-14 07:20 - 00015894 _____ C:\Users\Peter\Desktop\Addition.txt 2013-08-13 18:17 - 2013-08-13 18:17 - 00000000 ____D C:\Users\Peter\AppData\Local\PAYDAY 2013-08-13 16:53 - 2013-08-13 16:53 - 00000221 _____ C:\Users\Peter\Desktop\PAYDAY The Heist.url 2013-08-13 16:53 - 2013-08-13 16:53 - 00000000 ____D C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2013-08-13 15:41 - 2013-08-13 15:41 - 00000000 ____D C:\FRST 2013-08-13 15:40 - 2013-08-13 15:40 - 00000000 _____ C:\Users\Peter\defogger_reenable 2013-08-13 15:39 - 2013-08-14 07:06 - 00000000 ____D C:\Users\Peter\Desktop\Virenkampf 2013-08-13 15:38 - 2013-08-13 15:38 - 00377856 _____ C:\Users\Peter\Downloads\nn4icltp.exe 2013-08-13 10:33 - 2013-08-13 10:33 - 00000000 ____D C:\NvidiaLogging 2013-08-13 10:32 - 2013-05-14 21:28 - 00039712 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-08-13 10:32 - 2013-05-14 21:27 - 00029984 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2013-08-13 10:32 - 2013-05-14 21:27 - 00028448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-08-13 10:18 - 2013-08-13 10:18 - 00002007 _____ C:\Users\Public\Desktop\Live Update 5.lnk 2013-07-20 01:51 - 2013-07-20 01:51 - 00311608 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys 2013-07-20 01:50 - 2013-07-20 01:50 - 00246072 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys 2013-07-20 01:50 - 2013-07-20 01:50 - 00206648 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys 2013-07-20 01:50 - 2013-07-20 01:50 - 00071480 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys ==================== One Month Modified Files and Folders ======= 2013-08-14 17:35 - 2013-07-02 14:11 - 00000000 ____D C:\ProgramData\MFAData 2013-08-14 17:28 - 2013-08-14 17:28 - 00001708 _____ C:\Users\Peter\Desktop\JRT.txt 2013-08-14 17:25 - 2013-08-14 17:25 - 00000000 ____D C:\Windows\ERUNT 2013-08-14 17:24 - 2013-08-14 17:24 - 00004279 _____ C:\Users\Peter\Desktop\AdwCleaner[0].txt 2013-08-14 17:22 - 2013-08-14 17:20 - 00000000 ____D C:\AdwCleaner 2013-08-14 17:18 - 2012-07-14 13:57 - 00000000 ____D C:\Users\Peter\AppData\Local\PMB Files 2013-08-14 17:18 - 2012-07-14 13:57 - 00000000 ____D C:\ProgramData\PMB Files 2013-08-14 16:49 - 2013-04-25 21:34 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-08-14 16:41 - 2012-05-20 21:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-14 16:30 - 2013-08-14 16:30 - 01158897 _____ (Thisisu) C:\Users\Peter\Desktop\JRT.exe 2013-08-14 16:30 - 2013-08-14 16:30 - 00800594 _____ C:\Users\Peter\Desktop\adwcleaner.exe 2013-08-14 14:38 - 2013-08-14 14:38 - 01575570 _____ (Farbar) C:\Users\Peter\Desktop\FRST64.exe 2013-08-14 14:38 - 2012-05-14 02:22 - 00000000 ____D C:\Users\Peter 2013-08-14 14:30 - 2012-05-20 21:49 - 00000000 ____D C:\Program Files (x86)\Steam 2013-08-14 11:34 - 2013-08-14 11:34 - 00003878 _____ C:\Windows\System32\Tasks\Registration 1und1 Task 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\ProgramData\UUdb 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\ProgramData\1&1 Mail & Media GmbH 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\Program Files\WEB.DE MailCheck 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck 2013-08-14 11:34 - 2013-08-14 11:34 - 00000000 ____D C:\Program Files (x86)\1und1Softwareaktualisierung 2013-08-14 10:52 - 2013-08-14 10:52 - 00052146 _____ C:\Users\Peter\Desktop\bookmarks.html 2013-08-14 10:50 - 2013-08-14 10:50 - 00027896 _____ C:\Users\Peter\Desktop\bookmarks-2013-08-14.json 2013-08-14 07:39 - 2009-07-14 06:45 - 00027216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-14 07:39 - 2009-07-14 06:45 - 00027216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-14 07:35 - 2012-05-14 02:03 - 01794718 _____ C:\Windows\WindowsUpdate.log 2013-08-14 07:31 - 2013-04-25 21:34 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-08-14 07:31 - 2012-05-14 02:46 - 00000000 ____D C:\ProgramData\NVIDIA 2013-08-14 07:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-14 07:31 - 2009-07-14 06:51 - 00098214 _____ C:\Windows\setupact.log 2013-08-14 07:20 - 2013-08-14 07:19 - 00015894 _____ C:\Users\Peter\Desktop\Addition.txt 2013-08-14 07:06 - 2013-08-13 15:39 - 00000000 ____D C:\Users\Peter\Desktop\Virenkampf 2013-08-13 18:17 - 2013-08-13 18:17 - 00000000 ____D C:\Users\Peter\AppData\Local\PAYDAY 2013-08-13 18:17 - 2012-05-22 00:15 - 00716912 _____ C:\Windows\DirectX.log 2013-08-13 16:53 - 2013-08-13 16:53 - 00000221 _____ C:\Users\Peter\Desktop\PAYDAY The Heist.url 2013-08-13 16:53 - 2013-08-13 16:53 - 00000000 ____D C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2013-08-13 15:41 - 2013-08-13 15:41 - 00000000 ____D C:\FRST 2013-08-13 15:40 - 2013-08-13 15:40 - 00000000 _____ C:\Users\Peter\defogger_reenable 2013-08-13 15:38 - 2013-08-13 15:38 - 00377856 _____ C:\Users\Peter\Downloads\nn4icltp.exe 2013-08-13 12:15 - 2012-05-20 21:39 - 00000000 ____D C:\Program Files (x86)\Origin 2013-08-13 12:14 - 2012-05-20 21:41 - 00000000 ____D C:\Users\Peter\AppData\Local\Origin 2013-08-13 12:14 - 2012-05-20 21:39 - 00000000 ____D C:\Users\Peter\AppData\Roaming\Origin 2013-08-13 10:33 - 2013-08-13 10:33 - 00000000 ____D C:\NvidiaLogging 2013-08-13 10:33 - 2012-05-14 02:46 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2013-08-13 10:33 - 2012-05-14 02:41 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2013-08-13 10:29 - 2013-07-02 14:15 - 00000582 _____ C:\Users\Public\Desktop\AVG 2013.lnk 2013-08-13 10:18 - 2013-08-13 10:18 - 00002007 _____ C:\Users\Public\Desktop\Live Update 5.lnk 2013-08-13 05:44 - 2013-04-25 21:34 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-08-13 05:44 - 2013-04-25 21:34 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-07-20 01:51 - 2013-07-20 01:51 - 00311608 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys 2013-07-20 01:50 - 2013-07-20 01:50 - 00246072 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys 2013-07-20 01:50 - 2013-07-20 01:50 - 00206648 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys 2013-07-20 01:50 - 2013-07-20 01:50 - 00071480 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-08-13 11:28 ==================== End Of Log ============================ Code:
ATTFilter # AdwCleaner v3.000 - Report created14/08/2013at17:20:58 # Updated 13/08/2013 by Xplode # Operating System : Windows 7 Professional Service Pack 1 (64 bits) # Username : Peter - DIGITALATES # Running from : C:\Users\Peter\Desktop\adwcleaner.exe ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\Babylon Folder Deleted : C:\Users\Peter\AppData\Roaming\BabSolution Folder Deleted : C:\Users\Peter\AppData\Roaming\Babylon Folder Deleted : C:\Users\Peter\AppData\Roaming\dvdvideosoftiehelpers Folder Deleted : C:\Users\Peter\AppData\Roaming\OpenCandy File Deleted : C:\Users\Peter\AppData\Local\Temp\Uninstall.exe ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} Key Deleted : HKLM\SOFTWARE\5e2888ce73bec10 Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C8222B7-83EF-43F2-AF59-D4CAAD3D0853} Key Deleted : HKU\S-1-5-21-1779598452-667764557-2055712093-1004\Software\Microsoft\Internet Explorer\SearchScopes\{8C8222B7-83EF-43F2-AF59-D4CAAD3D0853} Key Deleted : HKCU\Software\BabSolution Key Deleted : HKCU\Software\DataMngr [#] Key Deleted : HKCU\Software\DataMngr_Toolbar Key Deleted : HKLM\Software\DataMngr ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16635 [OK] No bad entry found. -\\ Mozilla Firefox v22.0 (de) Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}] File Deleted : C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\searchplugins\11-suche.xml File Deleted : C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\searchplugins\Babylon.xml File Deleted : C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\searchplugins\delta.xml File Deleted : C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\foxydeal.sqlite File Deleted : C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\user.js [ File : C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\b0810lp1.default\prefs.js ] Line Deleted : user_pref("extensions.delta.admin", false); Line Deleted : user_pref("extensions.delta.aflt", "babsst"); Line Deleted : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}"); Line Deleted : user_pref("extensions.delta.autoRvrt", "false"); Line Deleted : user_pref("extensions.delta.dfltLng", "de"); Line Deleted : user_pref("extensions.delta.excTlbr", false); Line Deleted : user_pref("extensions.delta.ffxUnstlRst", true); Line Deleted : user_pref("extensions.delta.id", "54fec70a00000000000000ff310aae17"); Line Deleted : user_pref("extensions.delta.instlDay", "15882"); Line Deleted : user_pref("extensions.delta.instlRef", "sst"); Line Deleted : user_pref("extensions.delta.newTab", false); Line Deleted : user_pref("extensions.delta.prdct", "delta"); Line Deleted : user_pref("extensions.delta.prtnrId", "delta"); Line Deleted : user_pref("extensions.delta.rvrt", "false"); Line Deleted : user_pref("extensions.delta.smplGrp", "none"); Line Deleted : user_pref("extensions.delta.tlbrId", "base"); Line Deleted : user_pref("extensions.delta.tlbrSrchUrl", ""); Line Deleted : user_pref("extensions.delta.vrsn", "1.8.21.5"); Line Deleted : user_pref("extensions.delta.vrsnTs", "1.8.21.522:39:57"); Line Deleted : user_pref("extensions.delta.vrsni", "1.8.21.5"); Line Deleted : user_pref("extensions.delta_i.babExt", ""); Line Deleted : user_pref("extensions.delta_i.babTrack", "affID=121562&tt=250613_gr4&tsp=4925"); Line Deleted : user_pref("extensions.delta_i.srcExt", "ss"); Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .ti[...] Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*"); Line Deleted : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .titl[...] ************************* AdwCleaner[0].txt - [4141 octets] - [14/08/2013 17:20:58] ########## EOF - C:\AdwCleaner\AdwCleaner[0].txt - [4200 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.4.5 (08.13.2013:1) OS: Windows 7 Professional x64 Ran by Peter on 14.08.2013 at 17:25:34,09 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASMANCS ~~~ Files Successfully deleted: [File] "C:\Windows\wininit.ini" ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\Peter\appdata\local\{75955C33-3484-45C7-86D7-310CF2561ED1} Successfully deleted: [Empty Folder] C:\Users\Peter\appdata\local\{D64F693B-930C-4FD9-8BCF-E049AF707E29} Successfully deleted: [Empty Folder] C:\Users\Peter\appdata\local\{F38CBA55-37E1-42BC-8443-90B7232C6C45} ~~~ FireFox Successfully deleted: [File] C:\Users\Peter\AppData\Roaming\mozilla\firefox\profiles\b0810lp1.default\invalidprefs.js Emptied folder: C:\Users\Peter\AppData\Roaming\mozilla\firefox\profiles\b0810lp1.default\minidumps [298 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 14.08.2013 at 17:28:32,61 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
14.08.2013, 19:45 | #18 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Bildschirm friert ein aber Mauscursor bewegt sich, alles nach Inkassomail-Anhang Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)
__________________Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ |
Themen zu Bildschirm friert ein aber Mauscursor bewegt sich, alles nach Inkassomail-Anhang |
bewegt, bildschirm, bildschirm friert ein, erfolg, friert, friert ein, hänge, hängen, keine reaktion, klicke, klicken, mauscursor, mozilla, problem, reaktion, strg, tippen, tritt, öffnen |