Sorge um Infektion nach versuchtem Identitätsdiebstahl

Iskander · 10.09.2013, 18:40

Hallo liebe Trojaner-Board-Experten!

Wie der Titel schon andeutet, hat jemand vor ein paar Tagen versucht, mit meiner Kreditkarte über's Internet etwas zu erwerben. Das Ganze konnte ich zum Glück vermeiden, die Karte ist gesperrt und ich bin nochmal ohne schwere Folgen davongekommen. Dennoch ist nun natürlich die Sorge gross, dass sich auf meinem Rechner irgendwo etwas eingenistet hat.

Das erste was ich vor ein paar Tagen gemacht habe ist ein Suchdurchlauf mit Malwarebytes Anti-Malware. Dieser fand auch promt diverse Dinge, die ich dann versucht habe zu löschen (Eventuell ein Fehler, wenn ich mir eure Tipps und andere Threads so anschaue. Sorry, ich habe leider keine Ahnung.)... dies führte dazu, dass mein Rechner einfror und seitdem läuft alles extrem langsam. Nach zwei weiteren Suchdurchläufen mit Malwarebytes Anti-Malware wurde beide Male wieder was gefunden und auch das liess ich löschen (beide Male ohne Freeze). Zu guter Letzt habe ich dann noch mit Avira einen Suchdurchlauf gemacht, auch dort wurde etwas gefunden und auch dort habe ich das Programm säubern lassen.

Ich verfüge über die beiden letzten Malwarebytes Logs (das erste, bei dem alles einfror, wurde scheinbar nicht gespeichert) und auch den Avira Log. Leider sind beide auf Spanisch, ich wohne in Spanien und mein Rechner ist leider auch auf Spanisch... Deshalb habe ich das jetzt nicht direkt mitgepostet. Könnt ihr mir da überhaupt helfen? Kann gerne alles übersetzen, was nötig ist.

Wie gesagt, mein Rechner läuft seit all dem ziemlich langsam, friert dauernd bei Kleinigkeiten ein etc. Habe mich bisher deshalb nicht getraut irgendwas weiteres in die Richtung zu machen.

In jedem Fall Danke für eure Aufmerksamkeit!

cosinus · 10.09.2013, 18:54

Hallo und

Bitte alle Logs mit Funden posten. Also von Malwarebytes und AntiVir und evtl. anderen Scannern.

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Iskander · 10.09.2013, 19:00

Kommt sofort, vielen Dank!

Scan Nummer 1

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Versión de la Base de Datos: v2013.09.07.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Alex Siemon :: SKYWALKER [administrador]

07/09/2013 18:41:00
mbam-log-2013-09-07 (18-41-00).txt

Tipos de Análisis: Análisis Completo (C:\|)
Opciones de análisis activado: Memoria | Inicio | Registro | Sistema de archivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opciones de análisis desactivados: P2P
Objetos examinados: 174755
Tiempo transcurrido: 1 hora(s), 34 minuto(s), 12 segundo(s) [abortado]

Procesos en Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Módulos de Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Claves del Registro Detectados: 1
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> En cuarentena y eliminado con éxito.

Valores del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Carpetas Detectadas: 0
(No se han detectado elementos maliciosos)

Archivos Detectados: 1
C:\$Recycle.Bin\S-1-5-21-3017668548-1985129077-3354587888-1001\$RQMKSPR.exe (PUP.Optional.InstallCore) -> En cuarentena y eliminado con éxito.

fin)

Scan Nummer 2

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Versión de la Base de Datos: v2013.09.07.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Alex Siemon :: SKYWALKER [administrador]

08/09/2013 14:07:25
mbam-log-2013-09-08 (14-07-25).txt

Tipos de Análisis: Análisis Rápido
Opciones de análisis activado: Memoria | Inicio | Registro | Sistema de archivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opciones de análisis desactivados: P2P
Objetos examinados: 272785
Tiempo transcurrido: 13 minuto(s), 21 segundo(s)

Procesos en Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Módulos de Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Claves del Registro Detectados: 1
HKCR\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} (PUP.Optional.BrowseFox.A) -> En cuarentena y eliminado con éxito.

Valores del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Carpetas Detectadas: 3
C:\Users\Alex Siemon\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> En cuarentena y eliminado con éxito.
C:\Users\Alex Siemon\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> En cuarentena y eliminado con éxito.
C:\Users\Alex Siemon\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.21.5 (PUP.Optional.Delta.A) -> En cuarentena y eliminado con éxito.

Archivos Detectados: 0
(No se han detectado elementos maliciosos)

fin)

Avira Scan

Code:

ATTFilter

Avira Free Antivirus
Fecha de creación del fichero de informe: domingo, 08 de septiembre de 2013  22:04


El programa está funcionando como versión completa sin limitaciones.
Los servicios online están a disposición.

Titular de la licencia : Avira Free Antivirus
Número de serie        : 0000149996-ADJIE-0000001
Plataforma             : Windows Vista (TM) Home Premium
Versión de Windows     : (Service Pack 2)  [6.0.6002]
Modo de arranque       : Arranque normal
Nombre de usuario      : Alex Siemon
Nombre del equipo      : SKYWALKER

Información de versión:
BUILD.DAT              : 13.0.0.3885    54851 Bytes  05/08/2013 10:00:00
AVSCAN.EXE             : 13.6.0.1722   634936 Bytes  08/09/2013 13:29:29
AVSCANRC.DLL           : 13.6.0.1550    60472 Bytes  08/09/2013 13:29:29
LUKE.DLL               : 13.6.0.1550    65080 Bytes  08/09/2013 13:29:46
AVSCPLR.DLL            : 13.6.0.1712    92216 Bytes  08/09/2013 13:29:29
AVREG.DLL              : 13.6.0.1550   247864 Bytes  08/09/2013 13:29:28
avlode.dll             : 13.6.2.1704   449592 Bytes  08/09/2013 13:29:26
avlode.rdf             : 13.0.1.42      26846 Bytes  08/09/2013 13:30:05
VBASE000.VDF           : 7.11.70.0   66736640 Bytes  04/04/2013 13:28:50
VBASE001.VDF           : 7.11.74.226  2201600 Bytes  30/04/2013 13:28:53
VBASE002.VDF           : 7.11.80.60   2751488 Bytes  28/05/2013 13:28:55
VBASE003.VDF           : 7.11.85.214  2162688 Bytes  21/06/2013 13:28:57
VBASE004.VDF           : 7.11.91.176  3903488 Bytes  23/07/2013 13:29:00
VBASE005.VDF           : 7.11.98.186  6822912 Bytes  29/08/2013 13:29:06
VBASE006.VDF           : 7.11.98.187     2048 Bytes  29/08/2013 13:29:06
VBASE007.VDF           : 7.11.98.188     2048 Bytes  29/08/2013 13:29:06
VBASE008.VDF           : 7.11.98.189     2048 Bytes  29/08/2013 13:29:06
VBASE009.VDF           : 7.11.98.190     2048 Bytes  29/08/2013 13:29:06
VBASE010.VDF           : 7.11.98.191     2048 Bytes  29/08/2013 13:29:06
VBASE011.VDF           : 7.11.98.192     2048 Bytes  29/08/2013 13:29:06
VBASE012.VDF           : 7.11.98.193     2048 Bytes  29/08/2013 13:29:06
VBASE013.VDF           : 7.11.99.52    270848 Bytes  30/08/2013 13:29:06
VBASE014.VDF           : 7.11.99.167   210944 Bytes  02/09/2013 13:29:07
VBASE015.VDF           : 7.11.100.3    265216 Bytes  03/09/2013 13:29:07
VBASE016.VDF           : 7.11.100.95   220160 Bytes  04/09/2013 13:29:07
VBASE017.VDF           : 7.11.100.197   143872 Bytes  05/09/2013 13:29:07
VBASE018.VDF           : 7.11.101.11   227840 Bytes  06/09/2013 13:29:08
VBASE019.VDF           : 7.11.101.79   148480 Bytes  07/09/2013 13:29:08
VBASE020.VDF           : 7.11.101.80     2048 Bytes  07/09/2013 13:29:08
VBASE021.VDF           : 7.11.101.81     2048 Bytes  07/09/2013 13:29:08
VBASE022.VDF           : 7.11.101.82     2048 Bytes  07/09/2013 13:29:08
VBASE023.VDF           : 7.11.101.83     2048 Bytes  07/09/2013 13:29:08
VBASE024.VDF           : 7.11.101.84     2048 Bytes  07/09/2013 13:29:08
VBASE025.VDF           : 7.11.101.85     2048 Bytes  07/09/2013 13:29:08
VBASE026.VDF           : 7.11.101.86     2048 Bytes  07/09/2013 13:29:08
VBASE027.VDF           : 7.11.101.87     2048 Bytes  07/09/2013 13:29:08
VBASE028.VDF           : 7.11.101.88     2048 Bytes  07/09/2013 13:29:08
VBASE029.VDF           : 7.11.101.89     2048 Bytes  07/09/2013 13:29:08
VBASE030.VDF           : 7.11.101.90     2048 Bytes  07/09/2013 13:29:08
VBASE031.VDF           : 7.11.101.140   108544 Bytes  08/09/2013 13:29:08
Versión del motor      : 8.2.12.118
AEVDF.DLL              : 8.1.3.4       102774 Bytes  08/09/2013 13:29:13
AESCRIPT.DLL           : 8.1.4.148     516478 Bytes  08/09/2013 13:29:13
AESCN.DLL              : 8.1.10.4      131446 Bytes  08/09/2013 13:29:13
AESBX.DLL              : 8.2.16.26    1245560 Bytes  08/09/2013 13:29:14
AERDL.DLL              : 8.2.0.128     688504 Bytes  08/09/2013 13:29:13
AEPACK.DLL             : 8.3.2.24      749945 Bytes  08/09/2013 13:29:12
AEOFFICE.DLL           : 8.1.2.76      205181 Bytes  08/09/2013 13:29:12
AEHEUR.DLL             : 8.1.4.608    6148474 Bytes  08/09/2013 13:29:12
AEHELP.DLL             : 8.1.27.6      266617 Bytes  08/09/2013 13:29:10
AEGEN.DLL              : 8.1.7.14      446839 Bytes  08/09/2013 13:29:10
AEEXP.DLL              : 8.4.1.60      323959 Bytes  08/09/2013 13:29:14
AEEMU.DLL              : 8.1.3.2       393587 Bytes  08/09/2013 13:29:09
AECORE.DLL             : 8.1.32.0      201081 Bytes  08/09/2013 13:29:09
AEBB.DLL               : 8.1.1.4        53619 Bytes  08/09/2013 13:29:09
AVWINLL.DLL            : 13.6.0.1550    23608 Bytes  08/09/2013 13:27:55
AVPREF.DLL             : 13.6.0.1550    48184 Bytes  08/09/2013 13:29:28
AVREP.DLL              : 13.6.0.1550   175672 Bytes  08/09/2013 13:29:28
AVARKT.DLL             : 13.6.0.1626   258104 Bytes  08/09/2013 13:29:20
AVEVTLOG.DLL           : 13.6.0.1550   164920 Bytes  08/09/2013 13:29:22
SQLITE3.DLL            : 3.7.0.1       394824 Bytes  08/09/2013 13:29:55
AVSMTP.DLL             : 13.6.0.1550    59960 Bytes  08/09/2013 13:29:30
NETNT.DLL              : 13.6.0.1550    13368 Bytes  08/09/2013 13:29:49
RCIMAGE.DLL            : 13.4.0.360   4782880 Bytes  08/09/2013 13:27:56
RCTEXT.DLL             : 13.6.0.1624    67640 Bytes  08/09/2013 13:27:56

Configuración para el análisis actual:
Nombre de tarea.....................................: Unidades locales
Fichero de configuración............................: C:\Program Files\Avira\AntiVir Desktop\alldrives.avp
Registro............................................: Predeterminado
Acción principal....................................: interactivo
Acción secundaria...................................: omitir
Analizando sectores de arranque maestros............: activado
Analizando sectores de arranque.....................: activado
Sectores de arranque................................: C:, D:, F:, G:, H:, I:, E:, 
Analizando programas activos........................: activado
Analizando registro.................................: activado
Búsqueda de rootkits................................: desactivado
Comprobación de integridad de ficheros del sistema..: desactivado
Analizar todos los ficheros.........................: Selección inteligente de ficheros
Analizando archivos.................................: activado
Limitar nivel de recursividad.......................: 20
Extensiones inteligentes de archivo.................: activado
Heurística de macrovirus............................: activado
Heurística de ficheros..............................: Avanzado

Comienzo del análisis: domingo, 08 de septiembre de 2013  22:04

Comienza el análisis de los sectores de arranque maestros:
Sector de arranque maestro HD0
    [INFORMACIÓN] No se encontraron virus.

Comienza el análisis de los sectores de arranque:
Sector de arranque 'C:\'
    [INFORMACIÓN] No se encontraron virus.
Sector de arranque 'D:\'
    [INFORMACIÓN] No se encontraron virus.

Comienza el análisis de los procesos iniciados:
Analizando proceso 'avscan.exe' - se analizaron '93' módulos
Analizando proceso 'avcenter.exe' - se analizaron '105' módulos
Analizando proceso 'mobsync.exe' - se analizaron '42' módulos
Analizando proceso 'SyncServer.exe' - se analizaron '63' módulos
Analizando proceso 'distnoted.exe' - se analizaron '37' módulos
Analizando proceso 'svchost.exe' - se analizaron '21' módulos
Analizando proceso 'iPodService.exe' - se analizaron '36' módulos
Analizando proceso 'svchost.exe' - se analizaron '63' módulos
Analizando proceso 'AVWEBGRD.EXE' - se analizaron '59' módulos
Analizando proceso 'Remote UI Service.exe' - se analizaron '43' módulos
Analizando proceso 'mediaserver.exe' - se analizaron '130' módulos
Analizando proceso 'avshadow.exe' - se analizaron '33' módulos
Analizando proceso 'WUDFHost.exe' - se analizaron '38' módulos
Analizando proceso 'McSvHost.exe' - se analizaron '142' módulos
Analizando proceso 'mfefire.exe' - se analizaron '44' módulos
Analizando proceso 'taskeng.exe' - se analizaron '57' módulos
Analizando proceso 'mcshield.exe' - se analizaron '70' módulos
Analizando proceso 'MCLServiceATL.exe' - se analizaron '37' módulos
Analizando proceso 'ISSM.exe' - se analizaron '59' módulos
Analizando proceso 'WLIDSvcM.exe' - se analizaron '22' módulos
Analizando proceso 'SearchIndexer.exe' - se analizaron '61' módulos
Analizando proceso 'WLIDSVC.EXE' - se analizaron '71' módulos
Analizando proceso 'svchost.exe' - se analizaron '32' módulos
Analizando proceso 'svchost.exe' - se analizaron '52' módulos
Analizando proceso 'STacSV.exe' - se analizaron '40' módulos
Analizando proceso 'qualitymanager.exe' - se analizaron '33' módulos
Analizando proceso 'svchost.exe' - se analizaron '43' módulos
Analizando proceso 'PnkBstrA.exe' - se analizaron '37' módulos
Analizando proceso 'NMSCore.exe' - se analizaron '70' módulos
Analizando proceso 'mfevtps.exe' - se analizaron '35' módulos
Analizando proceso 'Iaantmon.exe' - se analizaron '38' módulos
Analizando proceso 'DQLWinService.exe' - se analizaron '29' módulos
Analizando proceso 'DAUpdaterSvc.Service.exe' - se analizaron '78' módulos
Analizando proceso 'CTsvcCDA.exe' - se analizaron '19' módulos
Analizando proceso 'CreativeLicensing.exe' - se analizaron '19' módulos
Analizando proceso 'svchost.exe' - se analizaron '33' módulos
Analizando proceso 'mDNSResponder.exe' - se analizaron '32' módulos
Analizando proceso 'KHALMNPR.EXE' - se analizaron '44' módulos
Analizando proceso 'AppleMobileDeviceService.exe' - se analizaron '69' módulos
Analizando proceso 'avguard.exe' - se analizaron '80' módulos
Analizando proceso 'AlertService.exe' - se analizaron '40' módulos
Analizando proceso 'SetpointII.exe' - se analizaron '41' módulos
Analizando proceso 'SSScheduler.exe' - se analizaron '39' módulos
Analizando proceso 'armsvc.exe' - se analizaron '30' módulos
Analizando proceso 'ehmsas.exe' - se analizaron '25' módulos
Analizando proceso 'ehtray.exe' - se analizaron '32' módulos
Analizando proceso 'avgnt.exe' - se analizaron '77' módulos
Analizando proceso 'iTunesHelper.exe' - se analizaron '73' módulos
Analizando proceso 'jusched.exe' - se analizaron '28' módulos
Analizando proceso 'svchost.exe' - se analizaron '60' módulos
Analizando proceso 'nvtray.exe' - se analizaron '55' módulos
Analizando proceso 'taskeng.exe' - se analizaron '51' módulos
Analizando proceso 'sched.exe' - se analizaron '56' módulos
Analizando proceso 'spoolsv.exe' - se analizaron '88' módulos
Analizando proceso 'RazerNagaSysTray.exe' - se analizaron '42' módulos
Analizando proceso 'CCU_Engine.exe' - se analizaron '41' módulos
Analizando proceso 'sttray.exe' - se analizaron '41' módulos
Analizando proceso 'LifeChat.exe' - se analizaron '43' módulos
Analizando proceso 'CCU_TrayIcon.exe' - se analizaron '31' módulos
Analizando proceso 'IntelHCTAgent.exe' - se analizaron '52' módulos
Analizando proceso 'IAAnotif.exe' - se analizaron '50' módulos
Analizando proceso 'ico.exe' - se analizaron '24' módulos
Analizando proceso 'wmdc.exe' - se analizaron '38' módulos
Analizando proceso 'taskeng.exe' - se analizaron '95' módulos
Analizando proceso 'Explorer.EXE' - se analizaron '150' módulos
Analizando proceso 'Dwm.exe' - se analizaron '46' módulos
Analizando proceso 'svchost.exe' - se analizaron '94' módulos
Analizando proceso 'WUDFHost.exe' - se analizaron '41' módulos
Analizando proceso 'nvvsvc.exe' - se analizaron '47' módulos
Analizando proceso 'nvxdsync.exe' - se analizaron '47' módulos
Analizando proceso 'svchost.exe' - se analizaron '90' módulos
Analizando proceso 'SLsvc.exe' - se analizaron '23' módulos
Analizando proceso 'svchost.exe' - se analizaron '37' módulos
Analizando proceso 'svchost.exe' - se analizaron '149' módulos
Analizando proceso 'svchost.exe' - se analizaron '115' módulos
Analizando proceso 'svchost.exe' - se analizaron '71' módulos
Analizando proceso 'svchost.exe' - se analizaron '44' módulos
Analizando proceso 'nvvsvc.exe' - se analizaron '36' módulos
Analizando proceso 'svchost.exe' - se analizaron '40' módulos
Analizando proceso 'winlogon.exe' - se analizaron '30' módulos
Analizando proceso 'lsm.exe' - se analizaron '28' módulos
Analizando proceso 'lsass.exe' - se analizaron '66' módulos
Analizando proceso 'services.exe' - se analizaron '39' módulos
Analizando proceso 'csrss.exe' - se analizaron '14' módulos
Analizando proceso 'wininit.exe' - se analizaron '30' módulos
Analizando proceso 'csrss.exe' - se analizaron '14' módulos
Analizando proceso 'smss.exe' - se analizaron '2' módulos

Se inicia el análisis de las referencias a ficheros ejecutables (registro):
Se analizó el registro ( '2814' ficheros ).


Comienza el análisis de los ficheros seleccionados:

Comenzando el análisis en 'C:\' <OS>
C:\Users\Alex Siemon\AppData\Local\Temp\oeEehOmm.exe.part
  [DETECCIÓN] Contiene patrones de detección del adware ADWARE/InstallIQ.L
    [0] Tipo de archivo: Runtime Packed
    --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
        [1] Tipo de archivo: Runtime Packed
      --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
          [2] Tipo de archivo: Runtime Packed
        --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
            [3] Tipo de archivo: Runtime Packed
          --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
              [4] Tipo de archivo: Runtime Packed
            --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
                [5] Tipo de archivo: Runtime Packed
              --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
                  [6] Tipo de archivo: Runtime Packed
                --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
                    [7] Tipo de archivo: Runtime Packed
                  --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
                      [8] Tipo de archivo: Runtime Packed
                    --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
                        [9] Tipo de archivo: Runtime Packed
                      --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
                          [10] Tipo de archivo: Runtime Packed
                        --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
                            [11] Tipo de archivo: Runtime Packed
                          --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
                              [12] Tipo de archivo: Runtime Packed
                            --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
                                [13] Tipo de archivo: Runtime Packed
                              --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
                                  [14] Tipo de archivo: Runtime Packed
                                --> C:\Users\Alex Siemon\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
                                    [15] Tipo de archivo: Runtime Packed
                                  --> C:\Users\Alex Siemon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\743fee9f-2bb028dd
                                      [16] Tipo de archivo: ZIP
                                    --> ________vload.class
                                        [DETECCIÓN] Contiene patrones de detección del virus de Java JAVA/Agent.AH
                                        [ADVERTENCIA] Los ficheros infectados en archivos no pueden repararse.
                                    --> vmain.class
                                        [DETECCIÓN] Contiene patrones de detección de la vulnerabilidad EXP/CVE-2008-5353.PA
                                        [ADVERTENCIA] Los ficheros infectados en archivos no pueden repararse.
C:\Users\Alex Siemon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\743fee9f-2bb028dd
  [DETECCIÓN] Contiene patrones de detección de la vulnerabilidad EXP/CVE-2008-5353.PA
Comenzando el análisis en 'D:\' <RECOVERY>
Comenzando el análisis en 'F:\'
No se pudo abrir la ruta para analizar F:\.
Error del sistema [21]: El dispositivo no está listo.
Comenzando el análisis en 'G:\'
No se pudo abrir la ruta para analizar G:\.
Error del sistema [21]: El dispositivo no está listo.
Comenzando el análisis en 'H:\'
No se pudo abrir la ruta para analizar H:\.
Error del sistema [21]: El dispositivo no está listo.
Comenzando el análisis en 'I:\'
No se pudo abrir la ruta para analizar I:\.
Error del sistema [21]: El dispositivo no está listo.
Comenzando el análisis en 'E:\'
No se pudo abrir la ruta para analizar E:\.
Error del sistema [21]: El dispositivo no está listo.

Iniciando la desinfección:
C:\Users\Alex Siemon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\743fee9f-2bb028dd
  [DETECCIÓN] Contiene patrones de detección de la vulnerabilidad EXP/CVE-2008-5353.PA
  [NOTA]      El fichero se movió al directorio de cuarentena usando el nombre '57a0fe12.qua'!
C:\Users\Alex Siemon\AppData\Local\Temp\oeEehOmm.exe.part
  [DETECCIÓN] Contiene patrones de detección del adware ADWARE/InstallIQ.L
  [NOTA]      El fichero se movió al directorio de cuarentena usando el nombre '4f25d1e6.qua'!


Fin del análisis: lunes, 09 de septiembre de 2013  07:30
Tiempo requerido:  3:25:25 Horas

El análisis se ejecutó por completo.

  63462 Directorios analizados
 993438 Ficheros analizados
      4 Virus o programas no deseados detectados
      0 Ficheros clasificados como sospechosos
      0 Ficheros eliminados
      0 Virus o programas no deseados reparados
      2 Ficheros movidos a cuarentena
      0 Se cambió el nombre de los ficheros
      0 No se pudieron analizar los ficheros
 993434 Ficheros no concernidos
   9842 Se analizaron los archivos
      2 Advertencias
      2 Notas

Wie gesagt, wenn ich irgendwas übersetzen soll, mach ich das gern.

cosinus · 10.09.2013, 19:42

Sieht nur nach Adware aus

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Iskander · 10.09.2013, 22:36

Mir fiel grad ein, dass ich am Sonntag bereits AdwCleaner laufen liess (Sorry, hatte das vergessen in meinem ersten Post). Es folgt nun das Log vom Sonntag, dann das Log von eben:

Code:

ATTFilter

# AdwCleaner v3.003 - Reporte Creado 07/09/2013 en 23:41:44
# Actualizado 07/09/2013 por Xplode
# Sistema Operativo : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Nombre de usuario : Alex Siemon - SKYWALKER
# Ejecutado desde : C:\Users\Alex Siemon\Desktop\adwcleaner.exe
# Opción : Limpiar

***** [ Servicios ] *****


***** [ Archivos / Carpetas ] *****

Carpeta Borrar : C:\ProgramData\Babylon
Carpeta Borrar : C:\Program Files\Ask.com
Carpeta Borrar : C:\Program Files\icqtoolbar
Carpeta Borrar : C:\Program Files\MyPC Backup 
Carpeta Borrar : C:\Users\ALEXSI~1\AppData\Local\Temp\AskSearch
Carpeta Borrar : C:\Users\Alex Siemon\AppData\Local\apn
Carpeta Borrar : C:\Users\Alex Siemon\AppData\LocalLow\AskToolbar
Carpeta Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\Conduit
Carpeta Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\CT2653012
Carpeta Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\Extensions\{cd90bf73-20f6-44ef-993d-bb920303bd2e}
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\\invalidprefs.js
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\bProtector_extensions.rdf
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\searchplugins\Askcom.xml
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\searchplugins\Babylon.xml
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\searchplugins\delta.xml
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\searchplugins\icqplugin.xml
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\searchplugins\icqplugin-1.xml
Archivo Borrar : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\user.js
Archivo Borrar : C:\Users\Alex Siemon\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
Archivo Borrar : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Accesos directos ] *****


***** [ Registro ] *****

[#] Clave Borrar : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[#] Clave Borrar : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{262E09C7-7822-4BFD-B7C5-29E7C7F6BBD6}
[#] Clave Borrar : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{262E09C7-7822-4BFD-B7C5-29E7C7F6BBD6}
Valor Borrar : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Clave Borrar : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Clave Borrar : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Clave Borrar : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Clave Borrar : HKLM\SOFTWARE\Classes\Prod.cap
Clave Borrar : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Clave Borrar : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Valor Borrar : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Clave Borrar : HKLM\SOFTWARE\5d55dc8fb435e543
Clave Borrar : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Clave Borrar : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Clave Borrar : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{39B217B4-8C69-4E45-A8DC-8CC4DAD3CF0A}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{3CB4CE45-8849-4638-9226-D6B615A15827}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{43AB7B5D-4C40-4103-A549-7002A116A7D5}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{996ED20F-A740-47A2-A7EF-9620D422BB4E}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clave Borrar : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Clave Borrar : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Clave Borrar : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Clave Borrar : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Clave Borrar : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Clave Borrar : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Clave Borrar : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}
Clave Borrar : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Clave Borrar : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clave Borrar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Clave Borrar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Clave Borrar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Clave Borrar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Clave Borrar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Clave Borrar : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clave Borrar : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BE9654C9-9D79-42EC-B55A-3CAEB12DBF58}
Valor Borrar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Valor Borrar : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Valor Borrar : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Clave Borrar : HKCU\Software\APN
Clave Borrar : HKCU\Software\Ask.com
Clave Borrar : HKCU\Software\BabSolution
Clave Borrar : HKCU\Software\Conduit
Clave Borrar : HKCU\Software\YahooPartnerToolbar
Clave Borrar : HKCU\Software\AppDataLow\Software\AskToolbar
Clave Borrar : HKLM\Software\APN
Clave Borrar : HKLM\Software\AskToolbar
Clave Borrar : HKLM\Software\DataMngr
Clave Borrar : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Clave Borrar : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Clave Borrar : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Clave Borrar : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Clave Borrar : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Producto Borrar : Ask Toolbar

***** [ Navegadores ] *****

-\\ Internet Explorer v9.0.8112.16502

Ajustes Restaurar : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v23.0.1 (es-ES)

[ Archivo : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\prefs.js ]

Linea borrada : user_pref("CT2653012.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Linea borrada : user_pref("CT2653012.CTID", "CT2653012");
Linea borrada : user_pref("CT2653012.CurrentServerDate", "29-10-2010");
Linea borrada : user_pref("CT2653012.DialogsAlignMode", "LTR");
Linea borrada : user_pref("CT2653012.DownloadReferralCookieData", "");
Linea borrada : user_pref("CT2653012.FirstServerDate", "29-10-2010");
Linea borrada : user_pref("CT2653012.FirstTime", true);
Linea borrada : user_pref("CT2653012.FirstTimeFF3", true);
Linea borrada : user_pref("CT2653012.FirstTimeSettingsDone", true);
Linea borrada : user_pref("CT2653012.FixPageNotFoundErrors", true);
Linea borrada : user_pref("CT2653012.GroupingServerCheckInterval", 1440);
Linea borrada : user_pref("CT2653012.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Linea borrada : user_pref("CT2653012.Initialize", true);
Linea borrada : user_pref("CT2653012.InitializeCommonPrefs", true);
Linea borrada : user_pref("CT2653012.InstallationAndCookieDataSentCount", 1);
Linea borrada : user_pref("CT2653012.InstalledDate", "Fri Oct 29 2010 21:47:43 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CT2653012.IsGrouping", false);
Linea borrada : user_pref("CT2653012.IsMulticommunity", false);
Linea borrada : user_pref("CT2653012.IsOpenThankYouPage", true);
Linea borrada : user_pref("CT2653012.IsOpenUninstallPage", true);
Linea borrada : user_pref("CT2653012.LanguagePackLastCheckTime", "Fri Oct 29 2010 21:47:43 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CT2653012.LanguagePackReloadIntervalMM", 1440);
Linea borrada : user_pref("CT2653012.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
Linea borrada : user_pref("CT2653012.LastLogin_2.7.1.3", "Fri Oct 29 2010 21:47:49 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CT2653012.LatestVersion", "2.7.2.0");
Linea borrada : user_pref("CT2653012.Locale", "en");
Linea borrada : user_pref("CT2653012.LoginCache", 4);
Linea borrada : user_pref("CT2653012.MCDetectTooltipHeight", "83");
Linea borrada : user_pref("CT2653012.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Linea borrada : user_pref("CT2653012.MCDetectTooltipWidth", "295");
Linea borrada : user_pref("CT2653012.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2653012&octid=EB_ORIGINAL_CTID&SearchSource=1");
Linea borrada : user_pref("CT2653012.SearchFromAddressBarIsInit", true);
Linea borrada : user_pref("CT2653012.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2653012&q=");
Linea borrada : user_pref("CT2653012.SearchInNewTabEnabled", true);
Linea borrada : user_pref("CT2653012.SearchInNewTabIntervalMM", 1440);
Linea borrada : user_pref("CT2653012.SearchInNewTabLastCheckTime", "Fri Oct 29 2010 21:47:49 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CT2653012.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
Linea borrada : user_pref("CT2653012.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");
Linea borrada : user_pref("CT2653012.SearchInNewTabUserEnabled", false);
Linea borrada : user_pref("CT2653012.SettingsCheckIntervalMin", 120);
Linea borrada : user_pref("CT2653012.SettingsLastCheckTime", "Fri Oct 29 2010 21:47:41 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CT2653012.SettingsLastUpdate", "1285580322");
Linea borrada : user_pref("CT2653012.ThirdPartyComponentsInterval", 504);
Linea borrada : user_pref("CT2653012.ThirdPartyComponentsLastCheck", "Fri Oct 29 2010 21:47:41 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CT2653012.ThirdPartyComponentsLastUpdate", "1246790578");
Linea borrada : user_pref("CT2653012.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=101&sealid=112");
Linea borrada : user_pref("CT2653012.UserID", "UN45428058197049015");
Linea borrada : user_pref("CT2653012.alertChannelId", "1045667");
Linea borrada : user_pref("CT2653012.clientLogIsEnabled", false);
Linea borrada : user_pref("CT2653012.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Linea borrada : user_pref("CT2653012.components.1000234", false);
Linea borrada : user_pref("CT2653012.myStuffEnabled", true);
Linea borrada : user_pref("CT2653012.myStuffPublihserMinWidth", 400);
Linea borrada : user_pref("CT2653012.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Linea borrada : user_pref("CT2653012.myStuffServiceIntervalMM", 1440);
Linea borrada : user_pref("CT2653012.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Linea borrada : user_pref("CT2653012.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
Linea borrada : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=");
Linea borrada : user_pref("CommunityToolbar.ToolbarsList", "CT2653012");
Linea borrada : user_pref("CommunityToolbar.ToolbarsList2", "CT2653012");
Linea borrada : user_pref("CommunityToolbar.alert.alertInfoInterval", 720);
Linea borrada : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Fri Oct 29 2010 21:47:41 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Linea borrada : user_pref("CommunityToolbar.alert.locale", "en");
Linea borrada : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Linea borrada : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Fri Oct 29 2010 21:47:41 GMT+0200 (Hora de verano romance)");
Linea borrada : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1283688156");
Linea borrada : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Linea borrada : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Linea borrada : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Linea borrada : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Linea borrada : user_pref("CommunityToolbar.alert.userId", "{5faf267b-55e1-4eb0-83be-248832e14686}");
Linea borrada : user_pref("extensions.delta.admin", false);
Linea borrada : user_pref("extensions.delta.aflt", "babsst");
Linea borrada : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Linea borrada : user_pref("extensions.delta.autoRvrt", "false");
Linea borrada : user_pref("extensions.delta.dfltLng", "es");
Linea borrada : user_pref("extensions.delta.excTlbr", false);
Linea borrada : user_pref("extensions.delta.ffxUnstlRst", true);
Linea borrada : user_pref("extensions.delta.id", "6c2f0992000000000000001e8c7c4471");
Linea borrada : user_pref("extensions.delta.instlDay", "15908");
Linea borrada : user_pref("extensions.delta.instlRef", "sst");
Linea borrada : user_pref("extensions.delta.newTab", false);
Linea borrada : user_pref("extensions.delta.prdct", "delta");
Linea borrada : user_pref("extensions.delta.prtnrId", "delta");
Linea borrada : user_pref("extensions.delta.rvrt", "false");
Linea borrada : user_pref("extensions.delta.smplGrp", "none");
Linea borrada : user_pref("extensions.delta.tlbrId", "base");
Linea borrada : user_pref("extensions.delta.tlbrSrchUrl", "");
Linea borrada : user_pref("extensions.delta.vrsn", "1.8.21.5");
Linea borrada : user_pref("extensions.delta.vrsnTs", "1.8.21.519:34:36");
Linea borrada : user_pref("extensions.delta.vrsni", "1.8.21.5");
Linea borrada : user_pref("extensions.delta_i.babExt", "");
Linea borrada : user_pref("extensions.delta_i.babTrack", "affID=119357&tsp=4951");
Linea borrada : user_pref("extensions.delta_i.srcExt", "ss");
Linea borrada : user_pref("icqtoolbar.engineVerified", false);
Linea borrada : user_pref("icqtoolbar.history", "radio%20rafaldo||tiro%20de%20tres%20radio%20contador||radio%20contador||lakers%20celtics||lakers||bulto%20en%20el%20ojo||vulto%20en%20el%20ojo||schwellung%20augapfel||[...]
Linea borrada : user_pref("icqtoolbar.installsource", "1");
Linea borrada : user_pref("icqtoolbar.numberOfSearches", 0);
Linea borrada : user_pref("icqtoolbar.previousFFVersion", "2.0.0.14");
Linea borrada : user_pref("icqtoolbar.uniqueID", "121266932112126693211213167726509");
Linea borrada : user_pref("icqtoolbar.usageStatstTimestamp", 1213880167);
Linea borrada : user_pref("icqtoolbar.version", "1.1.1");
Linea borrada : user_pref("browser.search.defaultengine", "Ask.com");

-\\ Google Chrome v

[ Archivo : C:\Users\Alex Siemon\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Borrar : homepage
Borrar : urls_to_restore_on_startup
Borrar : icon_url
Borrar : search_url
Borrar : keyword

*************************

AdwCleaner[R0].txt - [19216 octets] - [07/09/2013 23:39:54]
AdwCleaner[S0].txt - [17966 octets] - [07/09/2013 23:41:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18027 octets] ##########

Code:

ATTFilter

# AdwCleaner v3.003 - Reporte Creado 10/09/2013 en 23:09:19
# Actualizado 07/09/2013 por Xplode
# Sistema Operativo : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Nombre de usuario : Alex Siemon - SKYWALKER
# Ejecutado desde : C:\Users\Alex Siemon\Desktop\adwcleaner.exe
# Opción : Limpiar

***** [ Servicios ] *****


***** [ Archivos / Carpetas ] *****


***** [ Accesos directos ] *****


***** [ Registro ] *****

Valor Borrar : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

***** [ Navegadores ] *****

-\\ Internet Explorer v9.0.8112.16502


-\\ Mozilla Firefox v23.0.1 (es-ES)

[ Archivo : C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\prefs.js ]


-\\ Google Chrome v

[ Archivo : C:\Users\Alex Siemon\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [19216 octets] - [07/09/2013 23:39:54]
AdwCleaner[R1].txt - [1164 octets] - [07/09/2013 23:52:13]
AdwCleaner[R2].txt - [1225 octets] - [10/09/2013 23:08:23]
AdwCleaner[S0].txt - [18108 octets] - [07/09/2013 23:41:44]
AdwCleaner[S1].txt - [1140 octets] - [10/09/2013 23:09:19]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1200 octets] ##########

Hier das JRT Log:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.9 (09.07.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Alex Siemon on 10/09/2013 at 23:19:36,96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3017668548-1985129077-3354587888-1001\Software\SweetIM
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5B093A86-326D-402F-A51C-7F641B58872F}



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Alex Siemon\AppData\Roaming\mozilla\firefox\profiles\vmtemav4.default\minidumps [286 files]



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\extensioninstallforcelist [Blacklisted Policy]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10/09/2013 at 23:23:38,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-09-2013 01
Ran by Alex Siemon (administrator) on SKYWALKER on 10-09-2013 23:27:04
Running from C:\Users\Alex Siemon\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Spanish Modern Sort
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Primax Electronics Ltd.) C:\Windows\System32\ico.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Intel Corporation) C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
(Intel(R) Corporation) C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeChat\LifeChat.exe
(SigmaTel, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe
(Razer USA Ltd) C:\Program Files\Razer\Naga\RazerNagaSysTray.exe
(Intel(R) Corporation) C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
(Logitech Inc.) C:\Program Files\Logitech\SetPoint II\SetpointII.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel(R) Corporation) C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Creative Labs) C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
(Creative Technology Ltd) C:\Windows\system32\CTsvcCDA.exe
(BioWare) c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe
() C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
() C:\Windows\system32\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
(SigmaTel, Inc.) C:\Windows\system32\STacSV.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel(R) Corporation) C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
(Intel(R) Corporation) C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
() C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [PMX Daemon] - C:\Windows\System32\ICO.EXE [49152 2006-11-08] (Primax Electronics Ltd.)
HKLM\...\Run: [VolPanel] - C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe [180224 2006-11-27] (Creative Technology Ltd)
HKLM\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178712 2007-10-03] (Intel Corporation)
HKLM\...\Run: [NMSSupport] - C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe [439512 2007-06-27] (Intel Corporation)
HKLM\...\Run: [CCUTRAYICON] - C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe [215256 2007-06-27] (Intel(R) Corporation)
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [1838592 2008-01-25] (Google)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - "KHALMNPR.EXE"
HKLM\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [111936 2008-09-03] (Apple Inc.)
HKLM\...\Run: [LifeChat] - C:\Program Files\Microsoft LifeChat\LifeChat.exe [267296 2008-08-21] (Microsoft Corporation)
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-09-12] (SigmaTel, Inc.)
HKLM\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1318816 2011-11-22] (McAfee, Inc.)
HKLM\...\Run: [Razer Naga Driver] - C:\Program Files\Razer\Naga\RazerNagaSysTray.exe [953232 2011-04-12] (Razer USA Ltd)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-10] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Alex Siemon\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-01-20] (Google Inc.)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
Startup: C:\Users\Alex Siemon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recorte de pantalla e Inicio rápido de OneNote 2007.lnk
ShortcutTarget: Recorte de pantalla e Inicio rápido de OneNote 2007.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SetPointII.lnk
ShortcutTarget: SetPointII.lnk -> C:\Program Files\Logitech\SetPoint II\SetpointII.exe (Logitech Inc.)

==================== Internet (Whitelisted) ====================

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.es/ig/dell?hl=es&client=dell-row&channel=es&ibd=3080125
SearchScopes: HKLM - DefaultScope value is missing.
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20111229223011.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} hxxp://www.systemrequirementslab.com/sysreqlab2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 33 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 62.81.29.254 62.81.16.213

FireFox:
========
FF ProfilePath: C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default
FF Homepage: hxxp://www.youtube.com/
FF NetworkProxy: "no_proxies_on", "*.local"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX Content Upload Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @mcafee.com/MSC,version=10 - c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Alex Siemon\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Alex Siemon\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\drae.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-es.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-es.xml
FF Extension: No Name - C:\Users\Alex Siemon\AppData\Roaming\Mozilla\Firefox\Profiles\vmtemav4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] C:\Program Files\Common Files\McAfee\SystemCore
FF Extension: McAfee ScriptScan for Firefox - C:\Program Files\Common Files\McAfee\SystemCore

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (ICQ Search) - hxxp://www.google.com
CHR DefaultSuggestURL: (ICQ Search) -       "suggest_url": ""
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Alex Siemon\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Alex Siemon\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Alex Siemon\AppData\Local\Google\Chrome\Application\29.0.1547.66\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (BitCometAgent) - C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll (BitComet)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (DivX Web Player) - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll (DivX,Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (getPlusPlus for Adobe 16248) - C:\Program Files\Mozilla Firefox\plugins\np_gp.dll (NOS Microsystems Ltd.)
CHR Plugin: (DivX Content Upload Plugin) - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll No File
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\Alex Siemon\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~1\mcafee\msc\npmcsn~1.dll ()
CHR Extension: () - C:\Users\ALEXSI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfjgbcjfpbbfepcccpaffkjofcmglifg\1.0_0
CHR Extension: (YouTube) - C:\Users\ALEXSI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\ALEXSI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\ALEXSI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\ALEXSI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR StartMenuInternet: Google Chrome - C:\Users\Alex Siemon\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [223448 2007-06-27] (Intel(R) Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-10] (Avira Operations GmbH & Co. KG)
R2 Creative Labs Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe [72704 2008-01-25] (Creative Labs)
R2 Creative Service for CDROM Access; C:\Windows\system32\CTsvcCDA.exe [44032 1999-12-13] (Creative Technology Ltd)
R2 DAUpdaterSvc; c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [25832 2010-03-10] (BioWare)
S3 DHTRACE; C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe [39640 2007-06-27] (Intel(R) Corporation)
R2 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2007-02-12] ()
S3 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [51168 2009-09-23] (NOS Microsystems Ltd.)
S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [1838592 2008-01-25] (Google)
R2 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [59096 2007-06-27] (Intel(R) Corporation)
R2 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [268504 2007-06-27] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [157912 2007-06-27] (Intel(R) Corporation)
R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [214904 2011-01-27] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [214904 2011-01-27] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [214904 2011-01-27] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [214904 2011-01-27] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [361712 2011-06-23] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [214904 2011-01-27] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [166288 2011-10-18] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [160608 2011-10-18] (McAfee, Inc.)
R2 mfevtp; C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [150856 2011-10-18] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [214904 2011-01-27] (McAfee, Inc.)
R2 NMSCore; C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe [317656 2007-06-27] (Intel(R) Corporation)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2008-02-18] ()
R2 QualityManager; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe [272600 2007-06-27] (Intel(R) Corporation)
R2 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [446680 2007-06-27] (Intel(R) Corporation)
R2 STacSV; C:\Windows\system32\STacSV.exe [94208 2007-09-12] (SigmaTel, Inc.)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-09-08] (Avira Operations GmbH & Co. KG)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [57600 2011-10-15] (McAfee, Inc.)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-04-07] ()
R3 IntelDH; C:\Windows\System32\Drivers\IntelDH.sys [5632 2008-01-25] (Intel Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [121256 2011-10-15] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [180816 2011-10-15] (McAfee, Inc.)
R3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [59456 2011-10-15] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [338176 2011-10-15] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [464176 2011-10-15] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [64880 2011-10-15] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [87656 2011-10-15] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [34248 2009-09-16] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [40552 2009-09-16] (McAfee, Inc.)
R1 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [165680 2011-10-15] (McAfee, Inc.)
R2 nmsunidr; C:\Windows\System32\DRIVERS\nmsunidr.sys [5376 2007-02-18] (Gteko Ltd.)
R3 RzSynapse; C:\Windows\System32\DRIVERS\RzSynapse.sys [103424 2011-03-31] (Razer USA Ltd)
S3 SaiK0CC3; C:\Windows\System32\DRIVERS\SaiK0CC3.sys [138760 2010-04-22] (Saitek)
S3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [20744 2010-04-22] (Saitek)
S3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [43528 2010-04-22] (Saitek)
S3 SaiU0CC3; C:\Windows\System32\DRIVERS\SaiU0CC3.sys [35336 2010-04-22] (Saitek)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-08] (Avira GmbH)
R3 STHDA; C:\Windows\System32\drivers\stwrt.sys [326656 2007-09-12] (SigmaTel, Inc.)
S3 TSHWMDTCP; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys [14552 2007-06-27] ()
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
U3 mfeavfk01; No ImagePath
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-10 23:25 - 2013-09-10 23:26 - 01082349 _____ (Farbar) C:\Users\Alex Siemon\Desktop\FRST.exe
2013-09-10 23:23 - 2013-09-10 23:23 - 00001375 _____ C:\Users\Alex Siemon\Desktop\JRT.txt
2013-09-10 23:19 - 2013-09-10 23:19 - 00000000 ____D C:\Windows\ERUNT
2013-09-10 23:18 - 2013-09-10 23:19 - 01029490 _____ (Thisisu) C:\Users\Alex Siemon\Desktop\JRT.exe
2013-09-10 23:07 - 2013-09-10 23:07 - 01037278 _____ C:\Users\Alex Siemon\Desktop\adwcleaner.exe
2013-09-08 15:36 - 2013-09-08 15:36 - 00000000 ____D C:\Users\Alex Siemon\AppData\Roaming\Avira
2013-09-08 15:31 - 2013-09-08 15:31 - 00001849 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-08 15:30 - 2013-09-10 19:01 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-08 15:30 - 2013-09-10 19:01 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-08 15:30 - 2013-09-08 15:30 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-08 15:30 - 2013-09-08 15:30 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-09-08 15:30 - 2013-09-08 15:30 - 00000000 ____D C:\Program Files\Avira
2013-09-08 14:50 - 2013-08-30 09:47 - 00229648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-09-08 14:49 - 2013-09-08 15:02 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-08 14:48 - 2013-09-08 15:22 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-08 14:48 - 2013-09-08 14:48 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2013-09-08 14:46 - 2013-09-10 19:29 - 00000000 ____D C:\Users\Alex Siemon\Desktop\AV
2013-09-08 14:13 - 2013-09-08 14:49 - 00000000 ____D C:\ProgramData\HitmanPro
2013-09-07 23:39 - 2013-09-10 23:09 - 00000000 ____D C:\AdwCleaner
2013-09-07 23:24 - 2013-09-07 23:24 - 00800594 _____ C:\Users\Alex Siemon\Downloads\adwcleaner.exe
2013-09-03 17:00 - 2013-09-03 17:00 - 00026112 _____ C:\Users\Alex Siemon\Desktop\Plantilla_Sep2013.xls
2013-08-31 13:41 - 2013-08-31 13:41 - 00000216 _____ C:\Users\Alex Siemon\Desktop\Prison Architect.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\Uplink.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\Multiwinia.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\DEFCON.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\Darwinia.url
2013-08-30 14:24 - 2013-08-30 14:25 - 00000000 ____D C:\Users\Alex Siemon\Desktop\ANTIGAMA - Meteor
2013-08-30 14:21 - 2013-08-30 14:24 - 72052713 _____ C:\Users\Alex Siemon\Desktop\ANTIGAMA - Meteor.zip
2013-08-28 14:33 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-17 15:32 - 2013-08-17 15:33 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-17 15:32 - 2013-08-17 15:32 - 00000000 ____D C:\Program Files\iPod
2013-08-16 12:28 - 2013-08-16 12:28 - 00000000 ____D C:\Users\Alex Siemon\Desktop\cstns
2013-08-16 02:54 - 2013-08-16 02:56 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 02:47 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-16 02:47 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-16 02:47 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-16 02:46 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-16 02:46 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-16 02:46 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-16 02:46 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-16 02:46 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-16 02:46 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-16 02:46 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-16 02:46 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-16 02:46 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-16 02:46 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-16 02:46 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-16 02:46 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-16 02:46 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 21:45 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 21:45 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-15 21:45 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-15 21:44 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 21:44 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 21:44 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 21:44 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-15 21:44 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 21:44 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 21:44 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 21:44 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 21:44 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

==================== One Month Modified Files and Folders =======

2013-09-10 23:26 - 2013-09-10 23:26 - 00000000 ____D C:\FRST
2013-09-10 23:26 - 2013-09-10 23:25 - 01082349 _____ (Farbar) C:\Users\Alex Siemon\Desktop\FRST.exe
2013-09-10 23:23 - 2013-09-10 23:23 - 00001375 _____ C:\Users\Alex Siemon\Desktop\JRT.txt
2013-09-10 23:19 - 2013-09-10 23:19 - 00000000 ____D C:\Windows\ERUNT
2013-09-10 23:19 - 2013-09-10 23:18 - 01029490 _____ (Thisisu) C:\Users\Alex Siemon\Desktop\JRT.exe
2013-09-10 23:14 - 2008-01-25 12:22 - 02031222 _____ C:\Windows\WindowsUpdate.log
2013-09-10 23:12 - 2012-01-20 21:32 - 00001134 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3017668548-1985129077-3354587888-1001UA.job
2013-09-10 23:10 - 2012-04-16 07:55 - 00000838 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-10 23:10 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-10 23:10 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-10 23:10 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-10 23:09 - 2013-09-07 23:39 - 00000000 ____D C:\AdwCleaner
2013-09-10 23:09 - 2008-01-25 12:33 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-09-10 23:09 - 2006-11-02 15:01 - 00032644 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-10 23:07 - 2013-09-10 23:07 - 01037278 _____ C:\Users\Alex Siemon\Desktop\adwcleaner.exe
2013-09-10 23:03 - 2012-04-16 07:55 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-10 23:03 - 2011-05-17 23:36 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-10 19:29 - 2013-09-08 14:46 - 00000000 ____D C:\Users\Alex Siemon\Desktop\AV
2013-09-10 19:01 - 2013-09-08 15:30 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-10 19:01 - 2013-09-08 15:30 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-09 21:42 - 2010-05-22 02:29 - 00000000 ____D C:\Users\Alex Siemon\AppData\Roaming\Skype
2013-09-09 21:12 - 2012-01-20 21:32 - 00001082 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3017668548-1985129077-3354587888-1001Core.job
2013-09-08 15:36 - 2013-09-08 15:36 - 00000000 ____D C:\Users\Alex Siemon\AppData\Roaming\Avira
2013-09-08 15:34 - 2010-06-28 20:05 - 00059560 _____ C:\Windows\PFRO.log
2013-09-08 15:31 - 2013-09-08 15:31 - 00001849 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-08 15:30 - 2013-09-08 15:30 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-08 15:30 - 2013-09-08 15:30 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-09-08 15:30 - 2013-09-08 15:30 - 00000000 ____D C:\Program Files\Avira
2013-09-08 15:30 - 2013-03-18 00:15 - 00000000 ____D C:\ProgramData\Avira
2013-09-08 15:22 - 2013-09-08 14:48 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-08 15:13 - 2006-11-02 12:23 - 00002577 _____ C:\Windows\system32\config.nt
2013-09-08 15:02 - 2013-09-08 14:49 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-08 14:49 - 2013-09-08 14:13 - 00000000 ____D C:\ProgramData\HitmanPro
2013-09-08 14:49 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-09-08 14:48 - 2013-09-08 14:48 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2013-09-07 23:24 - 2013-09-07 23:24 - 00800594 _____ C:\Users\Alex Siemon\Downloads\adwcleaner.exe
2013-09-07 23:23 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Resources
2013-09-07 20:20 - 2009-01-27 23:30 - 00000000 ____D C:\Program Files\Steam
2013-09-03 17:00 - 2013-09-03 17:00 - 00026112 _____ C:\Users\Alex Siemon\Desktop\Plantilla_Sep2013.xls
2013-08-31 13:41 - 2013-08-31 13:41 - 00000216 _____ C:\Users\Alex Siemon\Desktop\Prison Architect.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\Uplink.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\Multiwinia.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\DEFCON.url
2013-08-31 13:41 - 2013-08-31 13:41 - 00000214 _____ C:\Users\Alex Siemon\Desktop\Darwinia.url
2013-08-31 13:41 - 2009-01-27 23:42 - 00000000 ____D C:\Users\Alex Siemon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-08-30 14:25 - 2013-08-30 14:24 - 00000000 ____D C:\Users\Alex Siemon\Desktop\ANTIGAMA - Meteor
2013-08-30 14:24 - 2013-08-30 14:21 - 72052713 _____ C:\Users\Alex Siemon\Desktop\ANTIGAMA - Meteor.zip
2013-08-30 09:47 - 2013-09-08 14:50 - 00229648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-08-30 00:25 - 2009-01-27 23:30 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-08-29 01:24 - 2013-01-25 00:58 - 00000000 ___RD C:\Program Files\Skype
2013-08-29 01:24 - 2010-05-22 02:28 - 00000000 ____D C:\ProgramData\Skype
2013-08-22 00:28 - 2006-11-02 12:33 - 01611654 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-19 13:40 - 2010-11-09 00:02 - 00013513 _____ C:\Windows\setupact.log
2013-08-17 15:33 - 2013-08-17 15:32 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-08-17 15:33 - 2012-09-16 13:25 - 00001666 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-08-17 15:33 - 2010-02-16 15:37 - 00000000 ____D C:\Program Files\iTunes
2013-08-17 15:32 - 2013-08-17 15:32 - 00000000 ____D C:\Program Files\iPod
2013-08-17 15:32 - 2008-02-05 00:28 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-08-17 15:13 - 2012-04-26 19:08 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-17 02:01 - 2008-03-05 20:51 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-16 17:09 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-16 12:43 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-08-16 12:28 - 2013-08-16 12:28 - 00000000 ____D C:\Users\Alex Siemon\Desktop\cstns
2013-08-16 02:56 - 2013-08-16 02:54 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 02:54 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-16 02:52 - 2008-01-25 12:39 - 00000000 ____D C:\ProgramData\Microsoft Help

Files to move or delete:
====================
C:\Users\ALEXSI~1\AppData\Local\Temp\AdobeUpdater12345.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\AskSLib.dll
C:\Users\ALEXSI~1\AppData\Local\Temp\askToolbarInstaller.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\BackupSetup.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\contentDATs.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\gbinit.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\GomEncDnInstaller.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\ALEXSI~1\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\ALEXSI~1\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\ALEXSI~1\AppData\Local\Temp\nvStInst.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\p25cli.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\Quarantine.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\SkypeSetup.exe
C:\Users\ALEXSI~1\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\ALEXSI~1\AppData\Local\Temp\uninst1.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-10 23:17

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 09-09-2013 01
Ran by Alex Siemon at 2013-09-10 23:29:27
Running from C:\Users\Alex Siemon\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 Update for Microsoft Office 2007 (KB2508958)
Actualización de NVIDIA 1.12.12 (Version: 1.12.12)
Actualización del controlador del Centro de dispositivos de Windows Mobile (Version: 6.1.6965.0)
Adobe Download Manager (Version: 1.6.2.48)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Flash Player ActiveX (Version: 9.0.124.0)
Adobe Reader X (10.1.7) - Español (Version: 10.1.7)
Amazon MP3 Downloader 1.0.9
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Assassin's Creed (Version: 1.02)
Assassin's Creed II (Version: 1.01)
Avira Free Antivirus (Version: 13.0.0.3885)
Bonjour (Version: 3.0.0.10)
Browser Address Error Redirector (Version: 1.00.0000)
Call of Duty(R) 4 - Modern Warfare(TM) (Version: 1.00.0000)
Call of Duty(R) 4 - Modern Warfare(TM) (Version: 1.6)
Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch (Version: 1.4)
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch (Version: 1.6)
Call of Duty: Black Ops
Call of Duty: Black Ops - Multiplayer
CCleaner (Version: 2.33)
Centro de dispositivos de Windows Mobile (Version: 6.1.6965.0)
Compatibilidad con Aplicaciones de Apple (Version: 2.3.4)
Compresor WinRAR
Creative MediaSource 5 (Version: 5.00)
D3DX10 (Version: 15.4.2368.0902)
Darwinia
DEFCON
Diablo III (Version: 1.0.5.12480)
DivX Web Player (Version: 1.4.2)
DJ_SF_03_D4300_Software_Min (Version: 110.0.206.000)
Dota 2
EA Download Manager (Version: 4.0.0.396)
EPSON Printer Software
Extensión de Windows Live Toolbar (Windows Live Toolbar) (Version: 03.01.0146)
G9 Device Package (Version: 1.00.0000)
GIMP 2.6.9 (Version: 2.6.9)
Google Chrome (HKCU Version: 29.0.1547.66)
Google Desktop (Version: -)
Guía de introducción de Dell (Version: 1.00.0000)
Guías del usuario
HiJackThis (Version: 1.0.0)
HP Deskjet D4300 Printer Driver 11.0 Rel .3 (Version: 11.0)
iCloud (Version: 2.1.2.8)
Intel(R) Matrix Storage Manager
Intel(R) PRO Network Connections 12.1.12.4 (Version: )
Intel(R) Viiv(TM) Software (Version: 1.7.512.0)
iTunes (Version: 11.0.5.5)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Java(TM) 6 Update 35 (Version: 6.0.350)
Java(TM) SE Runtime Environment 6 (Version: 1.6.0.0)
League of Legends (Version: 1.3)
Left 4 Dead 2
LIMBO
Logitech SetPoint 5.00 (Version: 5.00)
Magic: The Gathering - Duels of the Planeswalkers
Malwarebytes Anti-Malware versión 1.75.0.1300 (Version: 1.75.0.1300)
McAfee Security Scan Plus (Version: 3.0.318.3)
McAfee SecurityCenter (Version: 11.0.654)
Menús inteligentes (Windows Live Toolbar) (Version: 03.01.0146)
Microsoft .NET Framework 3.5 Language Pack SP1 - esn (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile ESN Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended ESN Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.88.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft LifeChat (Version: 1.30.196.0)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel 2007 Help Actualización (KB963678)
Microsoft Office Excel MUI (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Powerpoint 2007 Help Actualización (KB963669)
Microsoft Office PowerPoint MUI (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Basque) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Catalan) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Galician) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Portuguese (Brazil)) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (Spanish) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word 2007 Help Actualización (KB963665)
Microsoft Office Word MUI (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mouse Suite for Desktop Computers (Version: 2.50.025)
Mozilla Firefox 23.0.1 (x86 es-ES) (Version: 23.0.1)
Mozilla Maintenance Service (Version: 23.0.1)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 and SOAP Toolkit 3.0 (Version: 1.0.0.0)
Multiwinia
Mumble and Murmur (Version: 1.2.2)
My Screen Recorder 3.1
Naga Firmware Updater 1.13 (Version: 1.13.01)
NVIDIA Controlador de gráficos 314.07 (Version: 314.07)
NVIDIA Controlador de la controladora 3D Vision 314.07 (Version: 314.07)
NVIDIA Install Application (Version: 2.1002.109.706)
NVIDIA PhysX (Version: 9.12.1031)
NVIDIA Software del sistema PhysX 9.12.1031 (Version: 9.12.1031)
NVIDIA Update Components (Version: 1.12.12)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
Panel de control de MobileMe (Version: 2.1.0.24)
Panel de control de NVIDIA 314.07 (Version: 314.07)
Paquete de controladores de Windows - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (Version: 10/12/2007 6.85.4.0)
Paquete de idioma de Microsoft .NET Framework 3.5 SP1 - esn
Paquete de idioma de Microsoft .NET Framework 4 Client Profile ESN (Version: 4.0.30319)
Paquete de idioma de Microsoft .NET Framework 4 Extended ESN (Version: 4.0.30319)
PC Connectivity Solution (Version: 8.15.0.0)
Prison Architect
PunkBuster Services (Version: 0.987)
QuickTime (Version: 7.74.80.86)
RapidShare Manager (HKCU Version: 0.1.0.257)
Razer Game Booster (Version: 3.5.6.0)
Razer Naga (Version: 3.02.05)
Roxio Activation Module (Version: 1.0)
Roxio Creator Audio (Version: 3.5.0)
Roxio Creator BDAV Plugin (Version: 3.5.0)
Roxio Creator Copy (Version: 3.5.0)
Roxio Creator Data (Version: 3.5.0)
Roxio Creator Premier (Version: 3.5.0)
Roxio Creator Tools (Version: 3.5.0)
Roxio EasyArchive (Version: 3.5.0)
Roxio Express Labeler (Version: 3.2)
Roxio MyDVD Premier (Version: 9.1.573)
Roxio Update Manager (Version: 6.0.0)
Safari (Version: 5.34.57.2)
ScopeUserGuide (Version: 1.00.0000)
Segoe UI (Version: 15.4.2271.0615)
SES Driver (Version: 1.0.0)
Sid Meier's Civilization IV
Sid Meier's Civilization IV: Beyond the Sword
Sid Meier's Civilization IV: Colonization
Sid Meier's Civilization IV: Warlords
Skype™ 6.6 (Version: 6.6.106)
Sonic CinePlayer Decoder Pack (Version: 4.2.0)
Sound Blaster Audigy ADVANCED MB (Version: 1.0)
SPORE™ (Version: 1.00.0000)
Star Wars: The Old Republic (Version: 1.00)
StarCraft II (Version: 2.0.9.26147)
Steam (Version: 1.0.0.0)
System Requirements Lab
TeamSpeak 2 RC2 (Version: 2.0.32.60)
TeamSpeak 3 Client (Version: 3.0.10)
Toolbox (Version: 110.0.180.000)
Trillian
Ubisoft Game Launcher (Version: 1.0.0.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Uplink
Utilidad Configuración iPhone (Version: 2.1.0.163)
VC80CRTRedist - 8.0.50727.762 (Version: 1.0.0)
Ventrilo Client (Version: 3.0.5)
VideoLAN VLC media player 0.8.6e (Version: 0.8.6e)
Visor de resaltado (Windows Live Toolbar) (Version: 03.01.0146)
VoiceOver Kit (Version: 1.42.128.0)
Warcraft III
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Favorites para Windows Live Toolbar (Version: 03.01.0146)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3502.0922)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
World of Warcraft (Version: 4.2.2.14545)
 

==================== Restore Points  =========================

06-08-2013 13:46:01 Punto de control programado
07-08-2013 20:44:49 Punto de control programado
08-08-2013 13:57:13 Punto de control programado
09-08-2013 20:56:46 Punto de control programado
15-08-2013 20:33:25 Punto de control programado
16-08-2013 00:45:19 Windows Update
18-08-2013 23:42:37 Punto de control programado
19-08-2013 13:43:09 Punto de control programado
20-08-2013 13:55:42 Punto de control programado
21-08-2013 14:22:30 Punto de control programado
29-08-2013 01:00:16 Windows Update
30-08-2013 15:44:39 Punto de control programado
31-08-2013 15:11:19 Punto de control programado
03-09-2013 20:56:54 Punto de control programado
04-09-2013 14:07:41 Punto de control programado
05-09-2013 20:28:19 Punto de control programado
07-09-2013 14:22:16 Punto de control programado
08-09-2013 13:01:12 avast! Free Antivirus Setup
08-09-2013 13:15:39 avast! Free Antivirus Setup

==================== Hosts content: ==========================

2006-11-02 12:23 - 2010-06-28 09:32 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0993054B-D0F9-4D50-8BF0-B75184202D94} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {401E5BB0-23AB-4F3B-A367-C68E91617C21} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-19] (Microsoft Corporation)
Task: {41D438D3-9917-48EB-AD12-810556ECEBDE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3017668548-1985129077-3354587888-1001Core => C:\Users\Alex Siemon\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-20] (Google Inc.)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {5B08CB94-888E-4F82-AA11-C01F01B9DDC2} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-19] (Microsoft Corp.)
Task: {8EEF8D76-24D8-4DCA-8BFA-F0E7061733C0} - System32\Tasks\LifeChatTask => C:\Program Files\Microsoft LifeChat\LifeChat.exe [2008-08-21] (Microsoft Corporation)
Task: {95F1D89B-A2F1-4304-AFF4-FBF531D5865B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3017668548-1985129077-3354587888-1001UA => C:\Users\Alex Siemon\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-20] (Google Inc.)
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-19] (Microsoft Corporation)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\pla.dll [2008-01-19] (Microsoft Corporation)
Task: {A91C2305-2F87-482B-BF40-39ECA1141E83} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-10] (Adobe Systems Incorporated)
Task: {AB5FC613-B1AF-40D1-AD2D-2F36EC625997} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {B4410FDF-67F7-4BE2-A9B3-6DE6BD2878E3} - System32\Tasks\{FEDDD9CD-7C67-4C40-A6F7-D0E44E250ABB} => C:\Program Files\Skype\Phone\Skype.exe [2013-06-21] (Skype Technologies S.A.)
Task: {C438AC6D-8600-4067-AAB6-F5B633A6777D} - System32\Tasks\RunAsStdUser Task => C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {F7FA8C7B-A15B-4A5F-A753-95B085A990FC} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3017668548-1985129077-3354587888-1001Core.job => C:\Users\Alex Siemon\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3017668548-1985129077-3354587888-1001UA.job => C:\Users\Alex Siemon\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-10-10 22:14 - 2013-02-10 05:20 - 15038296 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dum.dll
2007-06-27 12:15 - 2007-06-27 12:15 - 00181976 _____ (Intel(R) Corporation) C:\Program Files\Intel\IntelDH\bin\IntelDH.dll
2007-06-27 12:19 - 2007-06-27 12:19 - 00137432 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\IntelDH\bin\CCU_ResMgr.dll
2007-06-27 12:19 - 2007-06-27 12:19 - 00129240 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\IntelDH\CCU\Language\ESN\ccu.dll
2008-01-25 12:22 - 2007-09-12 10:40 - 01601536 _____ (SigmaTel, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\STLang.dll
2008-01-25 20:17 - 2007-09-12 10:40 - 00244736 _____ (SigmaTel, Inc.) C:\Windows\system32\stapi32.dll
2011-04-12 15:29 - 2011-04-12 15:29 - 00428416 _____ (Razer USA Ltd) C:\Windows\system32\RzMwApi.dll
2007-06-27 12:18 - 2007-06-27 12:18 - 00019160 _____ (Intel(R) Corporation) C:\Program Files\Intel\IntelDH\CCU\AlertServicePS.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00053024 _____ (Open Source Software community project) C:\Program Files\Common Files\Apple\Apple Application Support\pthreadVC2.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-08-30 23:05 - 2011-08-30 23:05 - 00073064 _____ (Apple Inc.) C:\Windows\system32\dnssd.dll
2006-11-02 14:35 - 2006-11-02 14:35 - 00116736 _____ (Microsoft Corporation) C:\Windows\eHome\ehProxy.dll
2007-05-31 11:20 - 2007-05-31 11:20 - 00058248 _____ (Microsoft Corporation) C:\Windows\WindowsMobile\wmdsyncman.dll
2012-11-13 22:53 - 2012-11-13 22:53 - 00121472 _____ () C:\Program Files\Razer\Razer Game Booster\GBV3ContextMenu.dll
2008-07-06 01:08 - 2007-09-20 18:34 - 00129024 _____ () C:\Program Files\WinRAR\rarext.dll
2011-05-05 23:58 - 2013-08-17 02:01 - 03551640 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-03-17 23:47 - 2013-02-10 05:20 - 12862400 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2um.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================
Error: (03/16/2011 07:41:33 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (11/23/2010 07:43:52 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (07/28/2010 00:22:15 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (11/26/2008 11:40:48 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6308.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 693 seconds with 60 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2012-04-12 01:38:27.045
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:26.821
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:26.479
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:26.253
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:25.973
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:25.745
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18377_none_b2d96a966698ad63\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:22.390
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:22.209
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:22.008
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.

  Date: 2012-04-12 01:38:21.827
  Description: Integridad de código no puede comprobar la integridad de imagen del archivo \Device\HarddiskVolume3\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_b3144862666d6db3\tcpip.sys porque el conjunto de hashes de imagen por página no se encuentra en el sistema.


==================== Memory info =========================== 

Percentage of memory in use: 39%
Total physical RAM: 3069.22 MB
Available physical RAM: 1841.73 MB
Total Pagefile: 6343.5 MB
Available Pagefile: 4506.36 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.48 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:581.12 GB) (Free:206.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:15 GB) (Free:10.36 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596 GB) (Disk ID: 88000000)
Partition 1: (Not Active) - (Size=63 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=581 GB) - (Type=07 NTFS)

==================== End Of Log ============================

So, ich denke ich habe alles.

cosinus · 10.09.2013, 22:49

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Iskander · 11.09.2013, 10:54

Los geht's:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Versión de la Base de Datos: v2013.09.10.11

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Alex Siemon :: SKYWALKER [administrador]

11/09/2013 0:43:37
mbam-log-2013-09-11 (00-43-37).txt

Tipos de Análisis: Análisis Rápido
Opciones de análisis activado: Memoria | Inicio | Registro | Sistema de archivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opciones de análisis desactivados: P2P
Objetos examinados: 273988
Tiempo transcurrido: 8 minuto(s), 52 segundo(s)

Procesos en Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Módulos de Memoria Detectados: 0
(No se han detectado elementos maliciosos)

Claves del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Valores del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Detectados: 0
(No se han detectado elementos maliciosos)

Carpetas Detectadas: 0
(No se han detectado elementos maliciosos)

Archivos Detectados: 0
(No se han detectado elementos maliciosos)

fin)

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2d4400af7003f843a709ca1d86e532ca
# engine=15082
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-11 04:28:28
# local_time=2013-09-11 06:28:28 (+0100, Hora de verano romance)
# country="Spain"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=771 16777214 16 1 227166 227166 0 0
# compatibility_mode=1799 16775165 100 95 41187 226834 0 0
# compatibility_mode=5122 16777213 100 88 57249485 106405130 0 0
# compatibility_mode=5892 16776574 100 95 122507376 216406436 0 0
# scanned=313067
# found=0
# cleaned=0
# scan_time=19823

cosinus · 11.09.2013, 16:46

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Iskander · 11.09.2013, 20:39

Vielen Dank für die Tipps, werde sie befolgen.

Also ich habe nicht mehr den Eindruck, dass mein Rechner so langsam läuft wie die letzten Tage. Das war eigentlich vor allem am Sonntag so, vor/während den tausend Scan-Durchläufen mit tausend Programmen.

Natürlich besteht weiterhin die Sorge, da ja im Grunde nichts gefährliches gefunden wurde... Woher hatte der Dieb dann meine Daten? Wie warscheinlich ist es, deiner Ansicht nach, dass mein PC trotz allem irgendwo infiziert ist?

Bin mir natürlich schon bewusst, dass es da noch andere Möglichkeiten gibt, über die man unter Umständen an meine Daten hätte kommen können...

Wie dem auch sei, vielen Dank für deine Hilfe, bin auf jeden Fall beruhigter als zuvor (wenn ich auch in Zukunft wohl vorsichtiger seinw erde mit Online-Shops aller Art). Echt super, dass es Leute wie euch gibt!

cosinus · 11.09.2013, 20:44

Dann wären wir durch!

Falls du noch Lob oder Kritik loswerden möchtest => http://www.trojaner-board.de/lob-kritik-wuensche/

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden.

Helfen kann dir dabei delfix:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => http://filepony.de/1-browsers-and-plugins

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Sorge um Infektion nach versuchtem Identitätsdiebstahl

Plagegeister aller Art und deren Bekämpfung: Sorge um Infektion nach versuchtem Identitätsdiebstahl