Windows 7: Taskleiste bzw. Desktop wird regelmäßig gelockt (PUP.Optional.Somoto.A)

Teredor · 09.09.2013, 12:55

Hallo zusammen,

hab mir irgendwie etwas eingefangen es scheint (PUP.Optional.Somoto.A) zu sein. Habs zuerst mit Malware Bytes versucht (hats auch auf Anhieb gefunden), das Problem blieb trotzdem. Danach hab ich eine System-Widerherstellung versucht (weshalb auch der mbam-Bericht von vor der Widerherstellung leider futsch ist), aber leider wieder ohne Erfolg.

Damit ich diesen Thread schreiben konnte war es immer notwendig öfter mal den Task-Manager aufzurufen, welcher den Lock kurzzeitig aussetzt. Außerdem war es nicht möglich Dateien auf dem Desktop herum zu bewegen, man musste exakt mit Rechtklick und Kopieren und Einfügen arbeiten.

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:21 on 09/09/2013 (Daniel)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...
SPTD -> Disabled

-=E.O.F=-

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-09-2013
Ran by Daniel (administrator) on DANIEL-PC on 09-09-2013 13:26:29
Running from C:\Users\Daniel\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [Steam] - D:\Steam\steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [AdobeBridge] - 
MountPoints2: {10abd3f5-3e0f-11e2-9d12-c86000c976e6} - F:\HTC_Sync_Manager_PC.exe
MountPoints2: {2d3967a7-c163-11e2-acaa-c86000c976e6} - F:\HTC_Sync_Manager_PC.exe
MountPoints2: {3b86ce03-c45e-11e2-b026-c86000c976e6} - G:\HTC_Sync_Manager_PC.exe
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\UpdatusUser\...\Run: [Steam] - D:\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKU\UpdatusUser\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7M\ICQ.exe [127040 2012-07-19] (ICQ, LLC.)
HKU\UpdatusUser\...\RunOnce: [CTAutoUpdate] - C:\Program Files (x86)\Creative\Shared Files\Software Update\AutoUpdate.exe [430968 2009-01-15] (Creative Technology Ltd)
Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
ShortcutTarget: Xfire.lnk -> C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\picm10no.default
FF NewTab: about:blank
FF DefaultSearchEngine: Wikipedia (de)
FF SelectedSearchEngine: Wikipedia (de)
FF Homepage: hxxp://www.stern.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @raidcall.en/RCplugin - C:\Users\Daniel\AppData\Roaming\raidcall\plugins\nprcplugin.dll No File
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\ANNO 2070\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\picm10no.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

==================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2012-10-08] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-07-06] ()
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
S3 Workflow Manager Spatial Notification Service; C:\Program Files (x86)\ArcGIS\WorkflowManager\Bin\WMXSpatialNotificationService.exe [17408 2012-04-24] (ESRI)

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-01-26] ()
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-07-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-08-08] (DT Soft Ltd)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-01-26] ()
S3 RecFltr; C:\Windows\System32\drivers\RecFltr.sys [45440 2007-01-18] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [868848 2012-08-11] (Duplex Secure Ltd.)
S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-11] (MCCI Corporation)
S3 athr; system32\DRIVERS\athrx.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 MSICDSetup; \??\E:\CDriver64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-09 13:21 - 2013-09-09 13:21 - 00000576 _____ C:\Users\Daniel\Desktop\defogger_disable.log
2013-09-09 13:21 - 2013-09-09 13:21 - 00000188 _____ C:\Users\Daniel\defogger_reenable
2013-09-09 13:07 - 2013-09-09 13:14 - 00000000 ____D C:\AdwCleaner
2013-09-09 13:06 - 2013-09-09 13:06 - 01037278 _____ C:\Users\Daniel\Desktop\adwcleaner.exe
2013-08-28 10:58 - 2013-09-09 12:54 - 00000000 ____D C:\Users\Daniel\Desktop\Battlefield 3 - Soundtrack
2013-08-28 10:55 - 2013-08-28 10:55 - 00000201 _____ C:\Users\Daniel\Desktop\Command and Conquer Red Alert 3 - Uprising.url
2013-08-28 10:54 - 2013-08-28 10:54 - 00000201 _____ C:\Users\Daniel\Desktop\Mirror's Edge.url
2013-08-28 10:53 - 2013-08-28 10:53 - 00000202 _____ C:\Users\Daniel\Desktop\Crysis 2 Maximum Edition.url
2013-08-28 10:52 - 2013-08-28 10:52 - 00000201 _____ C:\Users\Daniel\Desktop\Burnout Paradise The Ultimate Box.url
2013-08-28 10:51 - 2013-08-28 10:51 - 00000201 _____ C:\Users\Daniel\Desktop\Dead Space.url
2013-08-27 10:39 - 2013-09-09 12:54 - 00000000 ____D C:\Users\Daniel\Desktop\Avenged Sevenfold - Hail to the King
2013-08-24 20:48 - 2013-08-28 10:03 - 00012559 _____ C:\Users\Daniel\Desktop\spielerverteilung.xlsx
2013-08-18 22:31 - 2013-08-18 22:31 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Daedalic Entertainment
2013-08-18 22:28 - 2013-08-18 22:28 - 00000000 ____D C:\Users\Daniel\Documents\Telltale Games
2013-08-17 12:31 - 2013-08-17 12:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 19:21 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 19:21 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 19:21 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 19:21 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 19:21 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 19:21 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 19:21 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 19:21 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 19:21 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 19:21 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 19:21 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 19:21 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 19:21 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 19:21 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 11:00 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-15 11:00 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-15 11:00 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 11:00 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-15 11:00 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 11:00 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 11:00 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-15 11:00 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 11:00 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 11:00 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 11:00 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 11:00 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 11:00 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-15 11:00 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-15 11:00 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-15 11:00 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-15 11:00 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-15 11:00 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-15 11:00 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-15 11:00 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-15 11:00 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-15 11:00 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-15 11:00 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-15 11:00 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-15 11:00 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-15 11:00 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 11:00 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-09 13:24 - 2013-09-09 13:24 - 01948948 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2013-09-09 13:21 - 2013-09-09 13:21 - 00000576 _____ C:\Users\Daniel\Desktop\defogger_disable.log
2013-09-09 13:21 - 2013-09-09 13:21 - 00000188 _____ C:\Users\Daniel\defogger_reenable
2013-09-09 13:21 - 2013-08-05 17:47 - 00000000 ____D C:\Users\Daniel\Desktop\Neuer Ordner
2013-09-09 13:21 - 2013-02-10 11:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-09 13:21 - 2012-07-19 00:22 - 00000000 ____D C:\Users\Daniel
2013-09-09 13:20 - 2012-07-30 23:04 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Xfire
2013-09-09 13:19 - 2009-07-14 06:45 - 00013536 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-09 13:19 - 2009-07-14 06:45 - 00013536 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-09 13:15 - 2012-07-19 00:22 - 01522637 _____ C:\Windows\WindowsUpdate.log
2013-09-09 13:14 - 2013-09-09 13:07 - 00000000 ____D C:\AdwCleaner
2013-09-09 13:12 - 2012-07-19 00:31 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-09 13:12 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-09 13:12 - 2009-07-14 06:51 - 00094033 _____ C:\Windows\setupact.log
2013-09-09 13:06 - 2013-09-09 13:06 - 01037278 _____ C:\Users\Daniel\Desktop\adwcleaner.exe
2013-09-09 13:05 - 2012-07-19 01:22 - 00000000 ____D C:\Users\Daniel\AppData\Local\Adobe
2013-09-09 13:00 - 2012-12-28 19:01 - 00000000 ____D C:\ProgramData\MFAData
2013-09-09 12:58 - 2012-07-30 23:04 - 00000000 ____D C:\ProgramData\Xfire
2013-09-09 12:54 - 2013-08-28 10:58 - 00000000 ____D C:\Users\Daniel\Desktop\Battlefield 3 - Soundtrack
2013-09-09 12:54 - 2013-08-27 10:39 - 00000000 ____D C:\Users\Daniel\Desktop\Avenged Sevenfold - Hail to the King
2013-09-09 12:54 - 2012-12-28 21:58 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\AVG2013
2013-09-09 12:54 - 2012-10-18 19:20 - 00000000 ___RD C:\Users\Daniel\Desktop\Spiele
2013-09-09 12:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-09-09 12:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-09-09 12:53 - 2012-10-07 15:49 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Skype
2013-09-07 16:07 - 2013-05-18 13:08 - 00000000 ____D C:\Users\Daniel\Documents\Anna
2013-09-02 12:29 - 2012-07-19 19:45 - 00001246 _____ C:\Users\Daniel\Desktop\Filme-Liste.txt
2013-08-29 14:47 - 2012-07-19 02:10 - 00307937 _____ C:\Windows\DirectX.log
2013-08-29 14:42 - 2012-07-19 21:14 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\TS3Client
2013-08-28 10:55 - 2013-08-28 10:55 - 00000201 _____ C:\Users\Daniel\Desktop\Command and Conquer Red Alert 3 - Uprising.url
2013-08-28 10:55 - 2012-07-19 02:21 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-08-28 10:54 - 2013-08-28 10:54 - 00000201 _____ C:\Users\Daniel\Desktop\Mirror's Edge.url
2013-08-28 10:53 - 2013-08-28 10:53 - 00000202 _____ C:\Users\Daniel\Desktop\Crysis 2 Maximum Edition.url
2013-08-28 10:52 - 2013-08-28 10:52 - 00000201 _____ C:\Users\Daniel\Desktop\Burnout Paradise The Ultimate Box.url
2013-08-28 10:51 - 2013-08-28 10:51 - 00000201 _____ C:\Users\Daniel\Desktop\Dead Space.url
2013-08-28 10:04 - 2013-06-15 11:38 - 00014198 _____ C:\Users\Daniel\Desktop\Comunio-Tabelle.xlsx
2013-08-28 10:03 - 2013-08-24 20:48 - 00012559 _____ C:\Users\Daniel\Desktop\spielerverteilung.xlsx
2013-08-27 20:49 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-27 10:55 - 2013-01-07 14:43 - 00008648 _____ C:\Users\Daniel\Desktop\'13.wpl
2013-08-25 12:42 - 2012-07-19 21:34 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\vlc
2013-08-23 11:33 - 2012-07-19 22:14 - 00000000 ____D C:\Users\Daniel\AppData\Local\PMB Files
2013-08-23 11:33 - 2012-07-19 22:14 - 00000000 ____D C:\ProgramData\PMB Files
2013-08-21 16:21 - 2013-02-10 11:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-21 16:21 - 2012-07-19 01:22 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-21 16:21 - 2012-07-19 01:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-19 18:57 - 2009-07-14 19:58 - 00773488 _____ C:\Windows\system32\perfh007.dat
2013-08-19 18:57 - 2009-07-14 19:58 - 00178170 _____ C:\Windows\system32\perfc007.dat
2013-08-19 18:57 - 2009-07-14 07:13 - 01828946 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-18 22:31 - 2013-08-18 22:31 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Daedalic Entertainment
2013-08-18 22:28 - 2013-08-18 22:28 - 00000000 ____D C:\Users\Daniel\Documents\Telltale Games
2013-08-18 12:21 - 2012-07-19 01:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 12:56 - 2013-08-17 12:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 00:00 - 2012-07-19 23:07 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\dvdcss
2013-08-16 19:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 19:18 - 2013-07-14 22:57 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 19:16 - 2012-07-19 02:39 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-12 18:19 - 2012-11-07 15:33 - 00000000 ____D C:\Users\Daniel\AppData\Local\Runic Games
2013-08-10 21:29 - 2012-08-11 14:37 - 00000000 ____D C:\Users\Daniel\Documents\My Games
2013-08-10 20:02 - 2012-07-19 21:35 - 00000000 ___RD C:\Users\Daniel\Desktop\Programme
2013-08-10 10:27 - 2013-07-06 14:18 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-10 10:27 - 2013-07-05 22:08 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-10 10:27 - 2013-07-05 22:08 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0

Files to move or delete:
====================
C:\Users\Daniel\AppData\Local\Temp\7z920.exe
C:\Users\Daniel\AppData\Local\Temp\appshat-distribution.exe
C:\Users\Daniel\AppData\Local\Temp\AskSLib.dll
C:\Users\Daniel\AppData\Local\Temp\bi_cleaner.exe
C:\Users\Daniel\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\Daniel\AppData\Local\Temp\COMAP.EXE
C:\Users\Daniel\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\Daniel\AppData\Local\Temp\Gw2.exe
C:\Users\Daniel\AppData\Local\Temp\jna8221972860291087941.dll
C:\Users\Daniel\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Daniel\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Daniel\AppData\Local\Temp\Medal of Honor_uninst.exe
C:\Users\Daniel\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Daniel\AppData\Local\Temp\MSIAFTERBURNERSETUP.EXE
C:\Users\Daniel\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Daniel\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Daniel\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Daniel\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Daniel\AppData\Local\Temp\nvStInst.exe
C:\Users\Daniel\AppData\Local\Temp\ose00000.exe
C:\Users\Daniel\AppData\Local\Temp\SETUP_AFTERBURNER.EXE
C:\Users\Daniel\AppData\Local\Temp\SHSetup.exe
C:\Users\Daniel\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Daniel\AppData\Local\Temp\sonarinst.exe
C:\Users\Daniel\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Daniel\AppData\Local\Temp\Uninstaller-5740.exe
C:\Users\Daniel\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Daniel\AppData\Local\Temp\_isEC61.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-01 20:08

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-09 13:38:11
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HDS721010CLA330 rev.JP4OA3MA 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Daniel\AppData\Local\Temp\kwrirpog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\AVG\AVG2013\avgui.exe[1332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000075351465 2 bytes [35, 75]
.text   C:\Program Files (x86)\AVG\AVG2013\avgui.exe[1332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000753514bb 2 bytes [35, 75]
.text   ...                                                                                                                              * 2
.text   C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000075351465 2 bytes [35, 75]
.text   C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000753514bb 2 bytes [35, 75]
.text   ...                                                                                                                              * 2
.text   C:\Windows\SysWOW64\PnkBstrA.exe[3240] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                          00000000732f1a22 2 bytes [2F, 73]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[3240] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                          00000000732f1ad0 2 bytes [2F, 73]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[3240] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                          00000000732f1b08 2 bytes [2F, 73]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[3240] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                          00000000732f1bba 2 bytes [2F, 73]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[3240] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                          00000000732f1bda 2 bytes [2F, 73]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[3240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000075351465 2 bytes [35, 75]
.text   C:\Windows\SysWOW64\PnkBstrA.exe[3240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000753514bb 2 bytes [35, 75]
.text   ...                                                                                                                              * 2

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2644:4436]                                                       000007fef02cc680
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2652:3944]                                                      000007feeffe838c
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2652:2208]                                                      000007fef02cc680

---- EOF - GMER 2.1 ----

Malwarebytes, wiegesagt hatte ich vor Systemwiderherstellung schon einmal durchlaufen lassen und hab natürlich auch die Dateien löschen lassen. Dieser Bericht ist nun hinten an alle anderen Berichte angehängt, sprich ganz zum Schluss gemacht.

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.09.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
Daniel :: DANIEL-PC [Administrator]

09.09.2013 13:39:59
MBAM-log-2013-09-09 (13-43-30).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 272632
Laufzeit: 3 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Daniel\AppData\Local\Temp\appshat-distribution.exe (PUP.Optional.Somoto.A) -> Keine Aktion durchgeführt.
C:\Users\Daniel\AppData\Local\Temp\UpdateCheckerSetup.exe (PUP.Optional.Somoto.A) -> Keine Aktion durchgeführt.

(Ende)

Danke schonmal für die Hilfe

MfG Teredor

Windows 7: Taskleiste bzw. Desktop wird regelmäßig gelockt (PUP.Optional.Somoto.A)

Log-Analyse und Auswertung: Windows 7: Taskleiste bzw. Desktop wird regelmäßig gelockt (PUP.Optional.Somoto.A)

Windows 7: Taskleiste bzw. Desktop wird regelmäßig gelockt (PUP.Optional.Somoto.A)

Ähnliche Themen: Windows 7: Taskleiste bzw. Desktop wird regelmäßig gelockt (PUP.Optional.Somoto.A)