![]() |
|
Plagegeister aller Art und deren Bekämpfung: Trojaner verdacht?, FRST.txt ansehen...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
![]() | ![]() Trojaner verdacht?, FRST.txt ansehen... Moin Moin Schrauber, hab hier mal wieder Rechner bei dem ein Trojaner am Werk sein könnte. Kannst du mal drüber schauen? Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-08-2013 Ran by admin (administrator) on 17-08-2013 08:43:39 Running from F:\ Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe () C:\Program Files\Web Assistant\ExtensionUpdaterService.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe (Ask) C:\Program Files\Ask.com\Updater\Updater.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Farbar) F:\FRST(2).exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\update.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\updrgui.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\update.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [] - [x] HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-04] (Avira Operations GmbH & Co. KG) ==================== Internet (Whitelisted) ==================== URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) URLSearchHook: DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {0890312C-07D6-4A80-8486-25D00927C36C} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=7687F137-A306-41CA-A32C-38E3EAED95B6&apn_sauid=D90966D3-8F0F-4AE6-BBC6-B2AFE2E33499 BHO: DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO: Web Assistant - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll () BHO: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD) BHO: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD) Toolbar: HKLM - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) Toolbar: HKLM - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKCU -DVDVideoSoftTB DE Toolbar - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) Toolbar: HKCU -Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\user.js FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml FF SelectedSearchEngine: Ask.com FF Homepage: hxxp://www.google.de FF Keyword.URL: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q= FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @videolan.org/vlc,version=2.0.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\searchplugins\askcom.xml FF Extension: incredibar.com - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\Extensions\ffxtlbr@incredibar.com FF Extension: Ask Toolbar - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\Extensions\toolbar@ask.com FF Extension: DVDVideoSoftTB DE Community Toolbar - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\Extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} FF Extension: admin - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\Extensions\admin@proxy-listen.de.xpi FF Extension: toolbar - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\Extensions\toolbar@gmx.net.xpi FF Extension: No Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\sqlwssa3.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] C:\Program Files\Web Assistant\Firefox FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] C:\Program Files\Web Assistant\Firefox FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox Chrome: ======= CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0 CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0 CHR Extension: (Web Assistant) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.602_0 CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0 CHR Extension: (Gmail) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0 CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-04] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-04] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-04] (Avira Operations GmbH & Co. KG) R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1528640 2012-02-06] (TuneUp Software) R2 Web Assistant; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-06-30] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-01] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-01] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-01] (Avira Operations GmbH & Co. KG) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2012-02-01] (TuneUp Software) S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x] S3 tsusbhub; system32\drivers\tsusbhub.sys [x] S3 VGPU; System32\drivers\rdvgkmd.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-17 08:42 - 2013-08-17 08:42 - 00000000 ____D C:\Users\admin\AppData\Local\AskToolbar 2013-08-16 22:46 - 2013-08-16 22:46 - 00001084 _____ C:\Users\Public\Desktop\PC Inspector smart recovery.lnk 2013-08-16 22:46 - 2013-08-16 22:46 - 00000000 ____D C:\Program Files\Convar 2013-08-16 22:46 - 2003-07-18 13:58 - 00516784 ____R (Xceed Software Inc (450) 442-2626 support@xceedsoft.com www.xceedsoft.com) C:\Windows\system32\XceedCry.dll 2013-08-16 22:46 - 2002-06-06 18:13 - 01077344 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCTL.OCX 2013-08-16 22:46 - 2002-04-12 13:19 - 00028672 _____ C:\Windows\system32\DartWeb.oca 2013-08-16 22:46 - 2002-02-28 09:46 - 00217088 _____ (Dart Communications) C:\Windows\system32\DartSock.dll 2013-08-16 22:46 - 2002-02-21 10:12 - 00118784 _____ (Dart Communications) C:\Windows\system32\DartWeb.dll 2013-08-16 22:46 - 2002-02-04 02:52 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\msxml4.dll 2013-08-16 22:46 - 2002-02-04 02:43 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\msxml4r.dll 2013-08-16 22:46 - 2002-02-04 02:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\msxml4a.dll 2013-08-16 22:46 - 2000-10-02 12:27 - 00125712 _____ (Microsoft Corporation) C:\Windows\system32\VB6DE.DLL 2013-08-16 22:46 - 2000-05-22 00:00 - 00140488 _____ (Microsoft Corporation) C:\Windows\system32\COMDLG32.OCX 2013-08-16 22:46 - 1998-06-13 22:53 - 00044544 _____ () C:\Windows\system32\Gif89.dll 2013-08-16 22:45 - 2013-08-16 22:45 - 00000000 ___HD C:\Program Files\InstallShield Installation Information 2013-08-16 22:44 - 2013-08-16 22:44 - 00000000 ____D C:\Program Files\Common Files\InstallShield 2013-08-16 22:38 - 2013-08-16 22:41 - 00000000 ____D C:\Windows\system32\MRT 2013-08-16 20:48 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-08-16 20:48 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-08-16 20:48 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-08-16 20:48 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-08-16 20:48 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-08-16 20:48 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-08-16 20:48 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-08-16 20:48 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-08-16 20:48 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-08-14 05:39 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-14 05:39 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-14 05:39 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2013-08-14 05:39 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-08-14 05:39 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-08-14 05:39 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-14 05:39 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-14 05:39 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-14 05:39 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-14 05:39 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-14 05:39 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-08-14 05:39 - 2013-06-15 05:40 - 00918528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2013-08-14 05:39 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2013-08-01 16:04 - 2013-08-01 16:04 - 00288696 _____ C:\Users\admin\Downloads\java%20portableSetup.exe 2013-08-01 15:55 - 2013-08-01 15:55 - 01067456 _____ (Solid State Networks) C:\Users\admin\Downloads\install_flashplayer11x32au_mssa_aaa_aih(1).exe ==================== One Month Modified Files and Folders ======= 2013-08-17 08:43 - 2013-08-17 08:43 - 00000000 ____D C:\FRST 2013-08-17 08:42 - 2013-08-17 08:42 - 00000000 ____D C:\Users\admin\AppData\Local\AskToolbar 2013-08-17 08:10 - 2012-05-02 04:41 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-17 03:15 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET 2013-08-17 03:11 - 2009-07-14 06:34 - 00017136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-17 03:11 - 2009-07-14 06:34 - 00017136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-17 03:04 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-17 03:03 - 2009-07-14 06:39 - 00064173 _____ C:\Windows\setupact.log 2013-08-17 03:01 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE 2013-08-17 03:00 - 2012-02-27 23:44 - 01442721 _____ C:\Windows\WindowsUpdate.log 2013-08-16 22:48 - 2012-02-27 23:56 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI 2013-08-16 22:46 - 2013-08-16 22:46 - 00001084 _____ C:\Users\Public\Desktop\PC Inspector smart recovery.lnk 2013-08-16 22:46 - 2013-08-16 22:46 - 00000000 ____D C:\Program Files\Convar 2013-08-16 22:45 - 2013-08-16 22:45 - 00000000 ___HD C:\Program Files\InstallShield Installation Information 2013-08-16 22:44 - 2013-08-16 22:44 - 00000000 ____D C:\Program Files\Common Files\InstallShield 2013-08-16 22:41 - 2013-08-16 22:38 - 00000000 ____D C:\Windows\system32\MRT 2013-08-16 22:38 - 2012-02-28 17:37 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-08-01 16:04 - 2013-08-01 16:04 - 00288696 _____ C:\Users\admin\Downloads\java%20portableSetup.exe 2013-08-01 15:55 - 2013-08-01 15:55 - 01067456 _____ (Solid State Networks) C:\Users\admin\Downloads\install_flashplayer11x32au_mssa_aaa_aih(1).exe 2013-07-28 16:28 - 2012-07-03 11:31 - 00000000 ____D C:\Program Files\Web Assistant 2013-07-26 05:13 - 2013-08-16 20:48 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-07-26 05:13 - 2013-08-16 20:48 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-07-26 05:13 - 2013-08-16 20:48 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-07-26 05:12 - 2013-08-16 20:48 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-07-26 05:12 - 2013-08-16 20:48 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-07-26 05:11 - 2013-08-16 20:48 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-07-26 05:11 - 2013-08-16 20:48 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-07-26 04:49 - 2013-08-16 20:48 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-07-26 03:59 - 2013-08-16 20:48 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-07-25 10:57 - 2013-08-14 05:39 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-07-19 03:41 - 2013-08-14 05:39 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-24 19:36 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-08-2013 Ran by admin at 2013-08-17 08:45:01 Running from F:\ Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe Flash Player 11 Plugin (Version: 11.7.700.224) Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7) Apple Application Support (Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (Version: 2.1.3.127) Ashampoo Burning Studio 2013 v.11.0.6 (Version: 11.0.6) Ask Toolbar (Version: 1.15.5.0) Ask Toolbar Updater (HKCU Version: 1.3.1.26360) Avira Free Antivirus (Version: 13.0.0.3885) Bonjour (Version: 3.0.0.10) calibre (Version: 0.9.31) Conexant HDA D110 MDC V.92 Modem DivX-Setup (Version: 2.6.1.8) DVDVideoSoftTB DE Toolbar (Version: 6.8.9.0) Free Video to iPhone Converter version 5.0.14.627 (Version: 5.0.14.627) iCloud (Version: 2.1.1.3) Incredibar Toolbar on IE Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.1930) iTunes (Version: 11.0.4.4) Java Auto Updater (Version: 2.1.6.0) Java(TM) 7 Update 3 (Version: 7.0.30) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Mozilla Firefox 22.0 (x86 de) (Version: 22.0) Mozilla Maintenance Service (Version: 22.0) PC Inspector smart recovery (Version: 4.50) QuickTime (Version: 7.74.80.86) RarmaRadio 2.68.3 Safari (Version: 5.34.57.2) TuneUp Utilities 2012 (Version: 12.0.3000.138) TuneUp Utilities Language Pack (de-DE) (Version: 12.0.3000.138) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0) VLC media player 2.0.0 (Version: 2.0.0) Web Assistant 2.0.0.602 (Version: 2.0.0.602) WinRAR 4.11 (32-Bit) (Version: 4.11.0) xp-AntiSpy 3.98-2 ==================== Restore Points ========================= ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {03ED0B9C-A942-4B5F-B65D-D3CE525725AE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {1A6740DE-CFDE-4B24-9FB8-2889F5045911} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files\TuneUp Utilities 2012\OneClick.exe [2012-02-06] (TuneUp Software) Task: {296EA78E-014D-467B-9755-B9829B625D1C} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated) Task: {74EC1CC6-B8CC-451B-B80F-7CFE221ABE36} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-07-29] () Task: {79C10BE8-71F4-4C97-83A9-C9154281A91E} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2012-08-22] () Task: {97F66044-D1AE-4E27-A8FC-6E8432BDA7A3} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-17] (Sun Microsystems, Inc.) Task: {D5073573-6281-4609-B186-2F0CB9CD4832} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-14] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/16/2013 10:28:20 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 5888718 Error: (08/16/2013 10:28:20 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 5888718 Error: (08/16/2013 10:28:20 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/02/2013 05:28:59 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00173668 ID des fehlerhaften Prozesses: 0x850 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (07/31/2013 03:08:33 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 31922 Error: (07/31/2013 03:08:33 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 31922 Error: (07/31/2013 03:08:33 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/31/2013 03:08:30 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00173668 ID des fehlerhaften Prozesses: 0xb98 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (07/31/2013 03:08:17 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 15625 Error: (07/31/2013 03:08:17 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 15625 System errors: ============= Error: (08/17/2013 03:02:16 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst Windows Modules Installer konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden. Error: (08/17/2013 00:07:59 AM) (Source: Ntfs) (User: ) Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar. Führen Sie auf dem Volume "Sicherung" den Befehl "chkdsk" aus. Error: (08/17/2013 00:07:59 AM) (Source: Ntfs) (User: ) Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar. Führen Sie auf dem Volume "Sicherung" den Befehl "chkdsk" aus. Error: (08/17/2013 00:07:56 AM) (Source: Ntfs) (User: ) Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar. Führen Sie auf dem Volume "Sicherung" den Befehl "chkdsk" aus. Error: (08/17/2013 00:07:56 AM) (Source: Ntfs) (User: ) Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar. Führen Sie auf dem Volume "Sicherung" den Befehl "chkdsk" aus. Error: (08/02/2013 05:35:15 AM) (Source: Serial) (User: ) Description: Bei der Überprüfung, ob "\Device\Serial0" ein serieller Anschluss ist, war der Inhalt des Divisor-Latch-Registers mit dem Interruptfreigabe- und dem Empfangsregister identisch. Das Gerät wurde nicht als serieller Anschluss erkannt und wird gelöscht. Error: (07/24/2013 08:20:12 PM) (Source: volsnap) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (07/14/2013 08:50:13 PM) (Source: volsnap) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (07/13/2013 09:55:46 AM) (Source: WMPNetworkSvc) (User: ) Description: WMPNetworkSvc0x80004005 Error: (07/11/2013 10:29:52 PM) (Source: volsnap) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Microsoft Office Sessions: ========================= Error: (08/16/2013 10:28:20 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 5888718 Error: (08/16/2013 10:28:20 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 5888718 Error: (08/16/2013 10:28:20 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/02/2013 05:28:59 PM) (Source: Application Error)(User: ) Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc00000050017366885001ce8f93429adb05C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll40340272-fb88-11e2-a5b6-0016419e6052 Error: (07/31/2013 03:08:33 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 31922 Error: (07/31/2013 03:08:33 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 31922 Error: (07/31/2013 03:08:33 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/31/2013 03:08:30 PM) (Source: Application Error)(User: ) Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668b9801ce8de20992fc4bC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll4abb4c10-f9e2-11e2-af65-0016419e6052 Error: (07/31/2013 03:08:17 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 15625 Error: (07/31/2013 03:08:17 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 15625 ==================== Memory info =========================== Percentage of memory in use: 53% Total physical RAM: 1270.18 MB Available physical RAM: 593.41 MB Total Pagefile: 2540.37 MB Available Pagefile: 1644.79 MB Total Virtual: 2047.88 MB Available Virtual: 1906.21 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:55.89 GB) (Free:4.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive f: () (Removable) (Total:15.05 GB) (Free:7.25 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 56 GB) (Disk ID: BC8984EE) Partition 1: (Active) - (Size=56 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 15 GB) (Disk ID: 0217934C) Partition 1: (Active) - (Size=15 GB) - (Type=0C) ==================== End Of Log ============================ mfg |
Themen zu Trojaner verdacht?, FRST.txt ansehen... |
administrator, antivir, antivirus, avira, bonjour, browser, converter, desktop, explorer, farbar, farbar recovery scan tool, flash player, helper, homepage, installation, mozilla, newtab, object, opera, plug-in, registry, scan, services.exe, software, svchost.exe, system, trojaner, trojaner verdacht, windows, winlogon.exe |