| |
| |||||||
Log-Analyse und Auswertung: Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem ForumWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.10.2013, 21:01
| #1 |
| |  Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum Hallo. Habe soeben den Rechner eines Feuewehr-Kameraden in Beschlag genommen und mich seines Problems mit dem Sicherheitscenter angenommen. - Habe den Rechner jetzt bei mir und möchte das Problem lösen. Problem: Sicherheitscenter nach dem Neustart ausgeschaltet. - Habe hier im Forum das Problem inkl. Lösung schon nachgeschlagen (gab´s vor gar nicht allzu langer Zeit hier schon mal), konnte aber anhand Eurer detaillierten und maßgeschneiderten Lösung das Problem aber nicht selbständig lösen. Daher findet Ihr jetzt hier alle notwendige Logfiles. Vielen Dank jetzt schon mal für die Beantwortung und Hilfe! Johannes defogger_disable Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:18 on 04/10/2013 (Tobias)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Tobias (administrator) on CHRISTIAN-BÜRO on 04-10-2013 21:21:04
Running from C:\Users\Tobias\Desktop\Dateien\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(HiTRSUT) C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
(Acer Inc.) C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
() C:\Program Files\Tor\tor.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(HiTRUST) C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
(CyberLink) C:\Acer\Empowering Technology\eAudio\eAudio.exe
(Realtek Semiconductor Corp.) C:\Users\Tobias\AppData\Local\Temp\RtkBtMnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Search-Results) C:\Program Files\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [ALaunch] - C:\Acer\ALaunch\AlaunchClient.exe
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor)
HKLM\...\Run: [eDataSecurity Loader] - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [457216 2007-04-25] (HiTRUST)
HKLM\...\Run: [eAudio] - C:\Acer\Empowering Technology\eAudio\eAudio.exe [1286144 2007-06-11] (CyberLink)
HKLM\...\Run: [Acer Tour] - [x]
HKLM\...\Run: [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe [772616 2007-08-15] (Dritek System Inc.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [Acer Tour Reminder] - C:\Acer\AcerTour\Reminder.exe [151552 2007-05-22] (Acer Inc.)
HKLM\...\Run: [WarReg_PopUp] - C:\Acer\WR_PopUp\WarReg_PopUp.exe [57344 2006-11-05] (Acer Inc.)
HKLM\...\Run: [SetPanel] - C:\Acer\APanel\APanel.cmd
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [55824 2007-09-21] (Logitech, Inc.)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [111936 2008-11-07] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2009-01-05] (Apple Inc.)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] - RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [Microsoft Default Manager] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339312 2010-09-15] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [886760 2011-08-25] (Search-Results)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - C:\Acer\AcerTour\Reminder.exe [151552 2007-05-22] (Acer Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [Device Detection] - C:\Program Files\Lidl_Fotos\dd.exe
HKCU\...\Run: [Rainlendar2] - C:\Program Files\Rainlendar2\Rainlendar2.exe
MountPoints2: {7299db37-be18-11dd-84cb-806e6f6e6963} - WD_Windows_Tools\Setup.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-04-26] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www2.delta-search.com/?affID=120519&tt=gc_&babsrc=HP_ss&mntrId=382D001B38D067D9
HKCU\Software\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www2.delta-search.com/?affID=120519&tt=gc_&babsrc=HP_ss&mntrId=382D001B38D067D9
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)
URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll No File
URLSearchHook: MyPlayCity Toolbar - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - C:\Program Files\MyPlayCity\tbMyPl.dll (Conduit Ltd.)
SearchScopes: HKLM - DefaultScope {CF739809-1C6C-47C0-85B9-569DBB141420} URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q={searchTerms}&crm=1
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1392740
SearchScopes: HKLM - {CF739809-1C6C-47C0-85B9-569DBB141420} URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q={searchTerms}&crm=1
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&affID=120519&tt=gc_&babsrc=SP_ss&mntrId=382D001B38D067D9
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&affID=120519&tt=gc_&babsrc=SP_ss&mntrId=382D001B38D067D9
SearchScopes: HKCU - {380002C7-37D5-4958-8D38-62D386438EFB} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKCU - {53E29E78-2FA3-4FF4-8C45-F60365BE1002} URL = hxxp://websearch.search-results.com/redirect?client=ie&tb=STC-SRS&o=41648033&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=96&apn_dtid=YYYYYYYYDE&apn_uid=5F953C26-48FA-4E55-8BE5-17BECD1E9A09&apn_sauid=425804C8-B7B6-406D-858C-C17FC770FCFD&
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {77AA3134-D51A-43F7-A4BF-4859267C1B14} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1392740
SearchScopes: HKCU - {BE9654C9-9D79-42ec-B55A-3CAEB12DBF58} URL = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {CF739809-1C6C-47C0-85B9-569DBB141420} URL = hxxp://websearch.ask.com/custom/java/redirect?client=ie&tb=ORJ&o=100000026&src=crm&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll No File
BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (IE Toolbar)
BHO: MyPlayCity Toolbar - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - C:\Program Files\MyPlayCity\tbMyPl.dll (Conduit Ltd.)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files\Delta\delta\1.8.16.16\bh\delta.dll (Delta-search.com)
BHO: Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
Toolbar: HKLM - Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll No File
Toolbar: HKLM - MyPlayCity Toolbar - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - C:\Program Files\MyPlayCity\tbMyPl.dll (Conduit Ltd.)
Toolbar: HKLM - Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)
Toolbar: HKLM - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files\Delta\delta\1.8.16.16\deltaTlbr.dll (Delta-search.com)
Toolbar: HKCU - No Name - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File
Toolbar: HKCU -Acer eDataSecurity Management - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} hxxp://www.lokalisten.de/iup/ImageUploader4.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default
FF user.js: detected! => C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\user.js
FF NewTab: hxxp://www2.delta-search.com/?affID=119556&tt=gc_&babsrc=NT_ss&mntrId=382D001B38D067D9
FF SearchEngineOrder.1: Delta Search
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=5F953C26-48FA-4E55-8BE5-17BECD1E9A09&apn_ptnrs=96&apn_sauid=425804C8-B7B6-406D-858C-C17FC770FCFD&apn_dtid=YYYYYYYYDE&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\ask.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\askcomsearch.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\BrowserProtect.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\search-results.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delta Toolbar - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\ffxtlbr@delta.com
FF Extension: gui:config - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\guiconfig@slosd.net
FF Extension: Search-Results Toolbar - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\toolbar@ask.com
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\trackerblock@privacychoice.org
FF Extension: Yahoo! Toolbar - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKCU\...\Firefox\Extensions: [happylyrics@hpyproductions.net] - C:\Program Files\HappyLyrics\FF\
FF Extension: No Name - C:\Program Files\HappyLyrics\FF\
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Docs) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Happy Lyrics) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj\1.111_0
CHR Extension: (Delta Toolbar) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0
CHR HKLM\...\Chrome\Extension: [ealchnonpofjocgofjpopjdoegbbkofj] - C:\Program Files\HappyLyrics\Chrome.crx
========================== Services (Whitelisted) =================
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-04-25] (HiTRSUT)
R2 eLockService; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [24576 2007-04-23] (Acer Inc.)
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-06-13] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-07-03] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-06-28] ()
S3 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2010-10-25] ()
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 tor; C:\Program Files\Tor\tor.exe [3233806 2013-09-05] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [167936 2007-09-14] (acer)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-31] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R1 DritekPortIO; C:\PROGRA~1\LAUNCH~1\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
S3 dsiarhwprog; C:\Windows\System32\Drivers\dsiarhwprog.sys [29184 2007-02-08] (Thesycon GmbH, Germany)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [25280 2008-04-10] (LogMeIn, Inc.)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20776 2007-04-25] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-04-25] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-04-25] (HiTRUST)
S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [83880 2007-12-10] (MCCI Corporation)
S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [15016 2007-12-10] (MCCI Corporation)
S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [110632 2007-12-10] (MCCI Corporation)
S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [104616 2007-12-10] (MCCI Corporation)
S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [25512 2007-12-10] (MCCI Corporation)
S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [100648 2007-12-10] (MCCI Corporation)
S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [110120 2007-12-10] (MCCI Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 LVRS; system32\DRIVERS\lvrs.sys [x]
S3 LVUSBSta; system32\drivers\LVUSBSta.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S3 PID_PEPI; system32\DRIVERS\LV302V32.SYS [x]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
U3 fwlyiuok; \??\C:\Users\Tobias\AppData\Local\Temp\fwlyiuok.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-04 21:19 - 2013-10-04 21:19 - 00000000 ____D C:\FRST
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-02 10:33 - 2013-10-02 10:34 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-19 21:26 - 2013-09-19 21:41 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-11 17:57 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 17:57 - 2013-08-01 12:21 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 17:57 - 2013-08-01 12:20 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 17:57 - 2013-08-01 12:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-11 17:57 - 2013-08-01 12:18 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 06016512 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 11111936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 02005504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-11 17:57 - 2013-08-01 12:15 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 17:57 - 2013-08-01 12:13 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2013-09-11 17:57 - 2013-08-01 10:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-09-11 17:57 - 2013-08-01 08:56 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 17:57 - 2013-08-01 08:56 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-11 17:57 - 2013-08-01 08:55 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-09-11 17:57 - 2013-08-01 08:54 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 17:57 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-09-06 19:41 - 2013-09-06 19:41 - 96462459 _____ C:\Windows\system32\宝幇ᰔž
2013-09-05 21:42 - 2013-09-05 22:38 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-09-05 12:25 - 2013-09-05 12:25 - 00000000 ____D C:\Program Files\Tor
==================== One Month Modified Files and Folders =======
2013-10-04 21:19 - 2013-10-04 21:19 - 00000000 ____D C:\FRST
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-04 21:18 - 2008-03-23 17:08 - 00000000 ____D C:\Users\Tobias
2013-10-04 21:00 - 2008-02-25 16:03 - 01699389 _____ C:\Windows\WindowsUpdate.log
2013-10-04 20:59 - 2012-04-30 13:55 - 00000440 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-04 19:37 - 2006-11-02 12:33 - 01445352 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-04 19:32 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.001
2013-10-04 19:32 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-04 19:32 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-04 09:47 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.dat
2013-10-04 09:21 - 2012-05-08 16:12 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-02 10:34 - 2013-10-02 10:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-28 22:09 - 2008-03-25 19:08 - 00007292 _____ C:\Users\Tobias\AppData\Roaming\wklnhst.dat
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-25 08:57 - 2006-11-02 14:52 - 00120082 _____ C:\Windows\setupact.log
2013-09-19 21:41 - 2013-09-19 21:26 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-17 22:14 - 2008-03-28 17:27 - 00023552 _____ C:\Users\Tobias\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-16 19:04 - 2013-06-27 18:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-16 19:04 - 2013-06-27 18:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-16 19:04 - 2012-04-22 13:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-14 20:26 - 2007-07-28 11:46 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 18:19 - 2006-11-02 14:47 - 00392680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 18:07 - 2013-07-14 21:43 - 00000000 ____D C:\Windows\system32\MRT
2013-09-11 18:04 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-09-06 23:31 - 2013-05-04 22:35 - 00000000 ____D C:\Program Files\HappyLyrics
2013-09-06 20:45 - 2007-07-28 12:05 - 00706880 _____ C:\Windows\PFRO.log
2013-09-06 20:17 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-06 19:41 - 2013-09-06 19:41 - 96462459 _____ C:\Windows\system32\宝幇ᰔž
2013-09-06 19:39 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-05 22:38 - 2013-09-05 21:42 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-09-05 12:25 - 2013-09-05 12:25 - 00000000 ____D C:\Program Files\Tor
2013-09-04 13:17 - 2013-01-11 17:25 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-04 13:17 - 2013-01-11 17:25 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\Temp\13387.exe
C:\Users\Tobias\AppData\Local\Temp\70048.exe
C:\Users\Tobias\AppData\Local\Temp\718631~1.exe
C:\Users\Tobias\AppData\Local\Temp\ApnStub.exe
C:\Users\Tobias\AppData\Local\Temp\AskSLib.dll
C:\Users\Tobias\AppData\Local\Temp\AutoRun.exe
C:\Users\Tobias\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Tobias\AppData\Local\Temp\bfguni.exe
C:\Users\Tobias\AppData\Local\Temp\bwgo001479a2.exe
C:\Users\Tobias\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\Tobias\AppData\Local\Temp\eauninstall.exe
C:\Users\Tobias\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\Tobias\AppData\Local\Temp\firefoxjre_exe-2.exe
C:\Users\Tobias\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Tobias\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Tobias\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Tobias\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Tobias\AppData\Local\Temp\Harry Potter and the Prisoner of Azkaban_uninst.exe
C:\Users\Tobias\AppData\Local\Temp\install_flashplayer11x32au_mssd_aaa_aih.exe
C:\Users\Tobias\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Tobias\AppData\Local\Temp\jre-1.6.0_20-windows-i586-iftw.exe_90744722.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u16-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u18-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u20-windows-i586-jinstall_uac.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Tobias\AppData\Local\Temp\moorhuhnx.exe
C:\Users\Tobias\AppData\Local\Temp\nsisdt.dll
C:\Users\Tobias\AppData\Local\Temp\ose00000.exe
C:\Users\Tobias\AppData\Local\Temp\ose00001.exe
C:\Users\Tobias\AppData\Local\Temp\RtkBtMnt.exe
C:\Users\Tobias\AppData\Local\Temp\setup.exe
C:\Users\Tobias\AppData\Local\Temp\setup_fsu_cid.exe
C:\Users\Tobias\AppData\Local\Temp\SIntf16.dll
C:\Users\Tobias\AppData\Local\Temp\SIntf32.dll
C:\Users\Tobias\AppData\Local\Temp\SIntfNT.dll
C:\Users\Tobias\AppData\Local\Temp\tempmessage.bfg
C:\Users\Tobias\AppData\Local\Temp\TW_autoskip.exe
C:\Users\Tobias\AppData\Local\Temp\uninst1.exe
C:\Users\Tobias\AppData\Local\Temp\UninstallRC-8876480.dll
C:\Users\Tobias\AppData\Local\Temp\war3_Install.exe
C:\Users\Tobias\AppData\Local\Temp\wmfdist.exe
C:\Users\Tobias\AppData\Local\Temp\wvc1dmo.exe
C:\Users\Tobias\AppData\Local\Temp\ycomp_setup.exe
C:\Users\Tobias\AppData\Local\Temp\_isED1C.exe
C:\Users\Tobias\AppData\Local\Temp\_isF2A8.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-04 19:37
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-04 21:49:26
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 WDC_WD2500BEVS-22UST0 rev.01.01A01 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Tobias\AppData\Local\Temp\fwlyiuok.sys
---- System - GMER 2.1 ----
SSDT 905D0A26 ZwCreateSection
SSDT 905D0A30 ZwRequestWaitReplyPort
SSDT 905D0A2B ZwSetContextThread
SSDT 905D0A35 ZwSetSecurityObject
SSDT 905D0A3A ZwSystemDebugControl
SSDT 905D09C7 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 82CDF860 4 Bytes [26, 0A, 5D, 90] {OR BL, [ES:EBP-0x70]}
.text ntkrnlpa.exe!KeSetEvent + 539 82CDFB84 4 Bytes [30, 0A, 5D, 90] {XOR [EDX], CL; POP EBP; NOP }
.text ntkrnlpa.exe!KeSetEvent + 56D 82CDFBB8 4 Bytes [2B, 0A, 5D, 90] {SUB ECX, [EDX]; POP EBP; NOP }
.text ntkrnlpa.exe!KeSetEvent + 5D1 82CDFC1C 4 Bytes [35, 0A, 5D, 90]
.text ntkrnlpa.exe!KeSetEvent + 619 82CDFC64 4 Bytes [3A, 0A, 5D, 90] {CMP CL, [EDX]; POP EBP; NOP }
.text ...
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8F808340, 0x3FA057, 0xE8000020]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Mozilla Firefox\firefox.exe[3620] ntdll.dll!LdrLoadDll 771E9378 5 Bytes JMP 64F4DFF0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3620] kernel32.dll!HeapSetInformation + 26 760DA8B0 7 Bytes JMP 64F55F1A C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3620] kernel32.dll!LockResource + C 760F6ACB 7 Bytes JMP 656D9773 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3620] kernel32.dll!VirtualAllocEx + 54 760FAF50 7 Bytes JMP 656D9796 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3620] GDI32.dll!SetStretchBltMode + 256 770A745C 7 Bytes JMP 656D96F4 C:\Program Files\Mozilla Firefox\xul.dll
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Tobias at 2013-10-04 21:23:04
Running from C:\Users\Tobias\Desktop\Dateien\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 7.1.8)
Acer Arcade Deluxe (Version: 1.12.4213)
Acer eAudio Management (Version: 2.5.4012)
Acer eDataSecurity Management (Version: 2.5.4241)
Acer eLock Management (Version: 2.5.4008)
Acer Empowering Technology (Version: 2.5.4010)
Acer eNet Management (Version: 2.6.4008)
Acer ePower Management (Version: 2.5.4021)
Acer ePresentation Management (Version: 2.5.4002)
Acer eSettings Management (Version: 2.5.4011)
Acer GridVista (Version: 2.68.622)
Acer Mobility Center Plug-In (Version: 1.0.3003)
Acer ScreenSaver (Version: 1.11.20070515)
Acer Tour (Version: 2.0.1003)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Media Player (Version: 1.6)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8)
AGEIA PhysX v7.11.13 (Version: 7.11.13)
ALPS Touch Pad Driver
Avira Free Antivirus (Version: 13.0.0.4052)
AviSynth 2.5
BrowserProtect
Delta toolbar (Version: 1.8.16.16)
Dynasty
Happy Lyrics
Haufe iDesk-Browser (Version: 10.10.14.0000)
Haufe iDesk-Service (Version: 10.10.25.7810)
HDAUDIO Soft Data Fax Modem with SmartCP
HP Officejet 6500 E710a-f - Grundlegende Software für das Gerät (Version: 22.0.334.0)
HP Officejet 6500 E710a-f Hilfe (Version: 140.0.2.2)
HP Photo Creations (Version: 1.0.0.9572)
HP Photosmart Essential (Version: 1.12.0.46)
HP Update (Version: 5.005.000.001)
HPDiagnosticAlert (Version: 1.00.0000)
HPSSupply (Version: 2.1.3.0000)
I.R.I.S. OCR (Version: 12.3.4)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Java(TM) 6 Update 14 (Version: 6.0.140)
Java(TM) 6 Update 37 (Version: 6.0.370)
Kies Air Discovery Service
Launch Manager
Lexware Info Service (Version: 2.70.00.0081)
LightScribe 1.4.142.1 (Version: 1.4.142.1)
Marketsplash Schnellzugriffe (Version: 1.0.0.9)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Default Manager (Version: 2.1.55.0)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access Runtime (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Search Enhancement Pack (Version: 3.0.127.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 08.05.0822)
MobileMe Control Panel (Version: 2.1.2.7)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
Mozilla Thunderbird 17.0.8 (x86 de) (Version: 17.0.8)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
MyPlayCity Toolbar (Version: )
NTI Backup NOW! 4.7 (Version: 4)
NTI CD & DVD-Maker (Version: 7)
NVIDIA Drivers
PowerProducer 3.72 (Version: 074117(3.7)_Vista_Acer)
QuickTime (Version: 7.60.92.0)
Realtek High Definition Audio Driver (Version: 6.0.1.5449)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (Version: 3.51.01)
Rollcage Stage II Demo
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.9.0)
Search-Results Toolbar (Version: 1.13.1.0)
Spelling Dictionaries Support For Adobe Reader 9 (Version: 9.0.0)
Star Wars(tm) Knights of the Old Republic(tm) II: The Sith Lords(tm) (Version: 1.00.0000)
Studie zur Verbesserung von HP Officejet 6500 E710a-f Produkten (Version: 22.0.334.0)
Thoosje Sevenbar
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
UseNeXT
Windows Live Call (Version: 14.0.8064.0206)
Windows Live Communications Platform (Version: 14.0.8064.206)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Live Messenger (Version: 14.0.8089.0726)
Windows Live-Uploadtool (Version: 14.0.8014.1029)
Yahoo! Toolbar
==================== Restore Points =========================
11-09-2013 15:47:29 Windows Update
11-09-2013 16:03:30 Windows Update
11-09-2013 17:08:30 Windows Update
13-09-2013 06:38:01 Windows Update
13-09-2013 07:19:32 Windows Update
13-09-2013 09:32:45 Windows Update
13-09-2013 10:34:27 Windows Update
13-09-2013 10:48:12 Windows Update
13-09-2013 11:46:22 Windows Update
14-09-2013 18:21:12 Windows Update
22-09-2013 17:12:13 Windows Update
27-09-2013 11:45:50 Windows Update
01-10-2013 13:15:03 Windows Update
==================== Hosts content: ==========================
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0785B53D-FD77-41C2-8E06-5369D0A7847C} - System32\Tasks\RunAsStdUser Task => C:\Program Files\Thoosje Sevenbar\Thoosje Sevenbar.exe [2009-08-11] ()
Task: {1B0CCEC1-1884-473D-98BD-2FB8FDBE682B} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {6405EBEA-B785-4EEF-B40E-B64F1413BE9D} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect
Task: {AB8714F2-9A85-4B9E-B8B4-D806F1430EDC} - System32\Tasks\RunAsStdUser Task for VeohWebPlayer => C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
Task: {C27A1B41-70E0-4B1E-9B8C-4DD92BAF1D45} - System32\Tasks\HPCustParticipation HP Officejet 6500 E710a-f => C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HPCustPartic.exe [2010-06-14] (Hewlett-Packard Co.)
Task: {C5F05374-DABC-4996-B26C-6981FB0D59C8} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {C716EC08-530E-4B2F-96BF-49873E0DD515} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2011-08-25] ()
Task: {CC32BABE-ED58-4B8D-A717-DF9286AA5AFF} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Tobias => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {DAB2DFBB-801B-4783-900F-6E70B93C3E02} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-16] (Adobe Systems Incorporated)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {EF3EFE7C-E49C-471C-A67F-3A56047214B7} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {F453841E-C00F-4931-ADA2-37AE921CCB13} - System32\Tasks\BFGLaunch_moorhuhnx => C:\Users\Tobias\AppData\Local\Temp\moorhuhnx.exe [2008-04-04] (Big Fish Games)
Task: {FA654C42-F60C-4E6C-8A4A-3FB1C7E84C8D} - System32\Tasks\BFGLaunch_bfgclient => C:\Program Files\bfgclient\bfgclient.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2007-04-25 16:30 - 2007-04-25 16:30 - 00063488 _____ () C:\Windows\system32\ShowErrMsg.dll
2007-04-25 16:31 - 2007-04-25 16:31 - 00028672 _____ () C:\Windows\system32\BatchCrypto.dll
2008-02-26 01:55 - 2003-06-07 07:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2013-10-02 10:33 - 2013-10-02 10:34 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:52B72A7C
AlternateDataStreams: C:\ProgramData\TEMP:73933431
AlternateDataStreams: C:\ProgramData\TEMP:8277EEB5
AlternateDataStreams: C:\ProgramData\TEMP:AFFC859A
AlternateDataStreams: C:\ProgramData\TEMP:F036C20D
AlternateDataStreams: C:\Users\Tobias\WG Vorlage Bestellung Erstbestückung.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/02/2013 06:55:11 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\NWE002L6.DEFAULT\SAFEBROWSING-BACKUP> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (09/28/2013 08:42:52 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\NWE002L6.DEFAULT\SAFEBROWSING-TO_DELETE> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (09/28/2013 08:42:52 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\NWE002L6.DEFAULT\SAFEBROWSING-BACKUP> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (09/23/2013 09:38:37 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\LINKS\CHRISTIAN SCHREIEGG HANDEL & SERVICE\BESETZUNG ADM NEU.XLSX> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (09/23/2013 09:38:37 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\LINKS\CHRISTIAN SCHREIEGG HANDEL & SERVICE\BESETZUNG ADM NEU.XLSX> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (09/15/2013 10:18:33 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\LINKS\1HOFMANN\BARBECOOK GRILLS\KATALOG-PREISE\2014\CATALOGUS_BBC_2014_DE_LR.PDF> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (09/15/2013 10:18:33 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\LINKS\1HOFMANN\BARBECOOK GRILLS\KATALOG-PREISE\2014\CATALOGUS_BBC_2014_DE_LR.PDF> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (09/14/2013 08:25:45 PM) (Source: Windows Search Service) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Kontext: Anwendung, SystemIndex Katalog
Error: (09/14/2013 08:25:45 PM) (Source: Windows Search Service) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Error: (09/13/2013 08:38:20 AM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\TOBIAS\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\NWE002L6.DEFAULT\SAFEBROWSING> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (10/04/2013 09:07:30 PM) (Source: ipnathlp) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
Error: (10/04/2013 09:00:23 PM) (Source: ipnathlp) (User: )
Description: Ein DHCP-Server mit der IP-Adresse 192.168.2.1 wurde von der DHCP-Zuweisung im selben Netzwerk gefunden, wie die Schnittstelle mit der IP-Adresse 192.168.0.1. Die Zuweisung wurde auf der Schnittstelle automatisch deaktiviert, um DHCP-Clientkonflikte zu vermeiden.
Error: (10/04/2013 09:00:23 PM) (Source: ipnathlp) (User: )
Description: 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner Fehler ist im Speicher-Manager aufgetreten.
Error: (10/04/2013 09:00:21 PM) (Source: Dhcp) (User: )
Description: Die IP-Adresslease 192.168.178.26 für die Netzwerkkarte mit der Netzwerkadresse 001B38D067D9 wurde durch den DHCP-Server 192.168.2.1 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).
Error: (10/04/2013 08:59:37 PM) (Source: ipnathlp) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
Error: (10/04/2013 07:32:00 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (10/04/2013 09:22:17 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (10/02/2013 06:53:32 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (10/02/2013 10:05:30 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (10/02/2013 07:01:11 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-09-16 21:39:14.879
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:39:14.155
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:39:13.316
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:39:12.582
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:29:38.393
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:29:37.530
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:29:36.779
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:29:36.007
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:29:07.068
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-16 21:29:06.338
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\MSNChatHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 52%
Total physical RAM: 2814.19 MB
Available physical RAM: 1333.34 MB
Total Pagefile: 5856.9 MB
Available Pagefile: 4266.6 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.6 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:111.69 GB) (Free:26.8 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:111.43 GB) (Free:104.71 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 233 GB) (Disk ID: E98A1772)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=112 GB) - (Type=06)
Partition 3: (Not Active) - (Size=111 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
04.10.2013, 22:18
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
05.10.2013, 11:52
| #3 |
| | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum Interessanterweise musste ich jetzt antivir deinstallieren, da es sich nicht mal per "Dienst/Prozess beenden" hat schließen lassen (Zugriff verweigert).
__________________hier das log-file combofix Code:
ATTFilter ComboFix 13-10-04.02 - Tobias 05.10.2013 12:31:01.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2814.1404 [GMT 2:00]
ausgeführt von:: c:\users\Tobias\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\acer\AcerTour\Reminder.exe
c:\users\Tobias\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
c:\users\Tobias\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences
c:\users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Videos.url
c:\windows\IsUn0407.exe
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\SET652B.tmp
c:\windows\system32\SET6608.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-09-05 bis 2013-10-05 ))))))))))))))))))))))))))))))
.
.
2013-10-05 10:39 . 2013-10-05 10:39 -------- d-----w- c:\users\Tobias\AppData\Local\temp
2013-10-05 10:39 . 2013-10-05 10:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-10-04 19:19 . 2013-10-04 19:19 -------- d-----w- C:\FRST
2013-10-04 07:29 . 2013-09-05 05:02 7328304 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4CDE1173-0A58-48A9-B711-05C685DCB4A6}\mpengine.dll
2013-09-05 19:42 . 2013-09-05 20:38 -------- d-----w- c:\program files\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-16 17:04 . 2013-06-27 16:35 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-16 17:04 . 2013-06-27 16:35 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-07 02:22 . 2009-10-02 19:32 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-08-02 04:09 . 2013-08-28 13:23 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-17 19:41 . 2013-08-15 13:07 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-10 09:47 . 2013-08-15 13:07 783360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 12:10 . 2013-08-15 13:06 1205168 ----a-w- c:\windows\system32\ntdll.dll
2013-07-08 17:53 . 2013-07-08 17:53 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-08 17:53 . 2012-07-08 18:23 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-07-08 17:53 . 2010-06-08 18:13 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-07-08 04:55 . 2013-08-15 13:06 3603904 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-07-08 04:55 . 2013-08-15 13:06 3551680 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-07-08 04:20 . 2013-08-15 13:06 172544 ----a-w- c:\windows\system32\wintrust.dll
2013-07-08 04:16 . 2013-08-15 13:06 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-08 04:16 . 2013-08-15 13:06 98304 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-08 04:16 . 2013-08-15 13:06 992768 ----a-w- c:\windows\system32\crypt32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-25 1515496]
"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyPl.dll" [2008-08-05 1610264]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
2008-08-05 01:13 1610264 ----a-w- c:\program files\MyPlayCity\tbMyPl.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyPl.dll" [2008-08-05 1610264]
.
[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-08-15 772616]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-06 159744]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 55824]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Skytel"="Skytel.exe" [2007-06-15 1826816]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 92704]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"LexwareInfoService"="c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-08-25 886760]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - avipbb
*Deregistered* - ssmdrv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-16 17:04]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www2.delta-search.com/?affID=120519&tt=gc_&babsrc=HP_ss&mntrId=382D001B38D067D9
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://de.intl.acer.yahoo.com
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=5F953C26-48FA-4E55-8BE5-17BECD1E9A09&apn_ptnrs=96&apn_sauid=425804C8-B7B6-406D-858C-C17FC770FCFD&apn_dtid=YYYYYYYYDE&q=
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Acer Tour Reminder - c:\acer\AcerTour\Reminder.exe
HKCU-Run-Device Detection - c:\program files\Lidl_Fotos\dd.exe
HKCU-Run-Rainlendar2 - c:\program files\Rainlendar2\Rainlendar2.exe
HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-Acer Tour Reminder - c:\acer\AcerTour\Reminder.exe
HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Rollcage Stage II Demo - c:\windows\IsUn0407.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-10-05 12:39
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-10-05 12:42:16
ComboFix-quarantined-files.txt 2013-10-05 10:42
.
Vor Suchlauf: 17 Verzeichnis(se), 28.853.002.240 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 33.815.212.032 Bytes frei
.
- - End Of File - - 66983BE0CB1968620A8F730E4614AAFF
A863475757CC50891AA8458C415E4B25
|
|
05.10.2013, 19:24
| #4 |
| /// the machine /// TB-Ausbilder | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.10.2013, 19:07
| #5 |
| | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum Hier die gewünschten logs. jrt Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Tobias on 06.10.2013 at 19:58:45,10
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4250610388-866271066-2412708980-1000\Software\SweetIM
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{53E29E78-2FA3-4FF4-8C45-F60365BE1002}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Tobias\AppData\Roaming\red kawa"
Successfully deleted: [Folder] "C:\Users\Tobias\appdata\locallow\asktoolbar"
~~~ FireFox
Emptied folder: C:\Users\Tobias\AppData\Roaming\mozilla\firefox\profiles\nwe002l6.default\minidumps [139 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.10.2013 at 20:03:14,97
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
adw cleaner Code:
ATTFilter # AdwCleaner v3.006 - Bericht erstellt am 06/10/2013 um 19:52:49
# Updated 01/10/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Tobias - CHRISTIAN-BÜRO
# Gestartet von : C:\Users\Tobias\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\OpenCandy
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserProtect
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\Program Files\Ask.com
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\Delta
Ordner Gelöscht : C:\Program Files\GamesBar
Ordner Gelöscht : C:\Program Files\HappyLyrics
Ordner Gelöscht : C:\Program Files\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files\icqtoolbar
Ordner Gelöscht : C:\Program Files\MyPlayCity
Ordner Gelöscht : C:\Windows\system32\BrowserProtect
Ordner Gelöscht : C:\Users\Tobias\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\Tobias\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Tobias\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Tobias\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Tobias\AppData\LocalLow\MyPlayCity
Ordner Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Ordner Gelöscht : C:\Program Files\Mozilla Firefox\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
Ordner Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\ffxtlbr@delta.com
Ordner Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\toolbar@ask.com
Ordner Gelöscht : C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\.autoreg
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\bProtector_extensions.rdf
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\bprotector_prefs.js
Datei Gelöscht : C:\Program Files\Mozilla Firefox\Components\AskSearch.js
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\Ask.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\askcomsearch.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\Babylon.xml
Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\BrowserProtect.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\delta.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserProtect
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [happylyrics@hpyproductions.net]
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BrowserProtect
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6405EBEA-B785-4EEF-B40E-B64F1413BE9D}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6405EBEA-B785-4EEF-B40E-B64F1413BE9D}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C716EC08-530E-4B2F-96BF-49873E0DD515}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C716EC08-530E-4B2F-96BF-49873E0DD515}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\BrowserProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKCU\Software\58edc8de538e514
Schlüssel Gelöscht : HKLM\SOFTWARE\58edc8de538e514
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BE9654C9-9D79-42EC-B55A-3CAEB12DBF58}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}]
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\delta LTD
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\HappyLyrics
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\MyPlayCity
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\GamesBarSetup
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\OpenCandy
Schlüssel Gelöscht : HKLM\Software\Uniblue\DriverScanner
Schlüssel Gelöscht : HKLM\Software\MyPlayCity
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPlayCity Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Delta
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Optimizer Pro_is1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPlayCity Toolbar
Produkt Gelöscht : Search-Results Toolbar
***** [ Browser ] *****
-\\ Internet Explorer v8.0.6001.19458
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
-\\ Mozilla Firefox v24.0 (de)
[ Datei : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www2.delta-search.com/?affID=119556&tt=gc_&babsrc=NT_ss&mntrId=382D001B38D067D9");
Zeile gelöscht : user_pref("browser.search.defaultengine", "Search-Results");
Zeile gelöscht : user_pref("browser.search.order.1", "Delta Search");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.bbDpng", "6");
Zeile gelöscht : user_pref("extensions.delta.cntry", "DE");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.hdrMd5", "E360FA35148425596C31B0927D7A51FA");
Zeile gelöscht : user_pref("extensions.delta.id", "382da49e000000000000001b38d067d9");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15831");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.lastVrsnTs", "1.8.16.1611:15:08");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.sg", "azb");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "azb");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.16.16");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.16.1611:15:08");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.16.16");
Zeile gelöscht : user_pref("extensions.enabledAddons", "ffxtlbr%40delta.com:1.5.0,guiconfig%40slosd.net:1.2.2,trackerblock%40privacychoice.org:2.2,%7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:2.5.9.20130409112616,%7B20a[...]
Zeile gelöscht : user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}:6.0.33,{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}:6.0.35,{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}:6.0.37,ffxtlbr@delta.com:1.5.0,[...]
Zeile gelöscht : user_pref("extensions.snipit.askTbInstalled", true);
Zeile gelöscht : user_pref("extensions.snipit.chromeURL", "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q={searchTerms}&crm=1");
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);
Zeile gelöscht : user_pref("icqtoolbar.history", "pst%20import%20thunderbird");
Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.5.2");
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "yes");
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "124819114912481911491249231377776");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1249909858);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=5F953C26-48FA-4E55-8BE5-17BECD1E9A09&apn_ptnrs=96&apn_sauid=425804C8-[...]
-\\ Google Chrome v
[ Datei : C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [22456 octets] - [06/10/2013 19:51:45]
AdwCleaner[S0].txt - [18266 octets] - [06/10/2013 19:52:49]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18327 octets] ##########
malware bytes Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.06.04 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 8.0.6001.19458 Tobias :: CHRISTIAN-BÜRO [Administrator] Schutz: Deaktiviert 06.10.2013 19:31:28 mbam-log-2013-10-06 (19-31-28).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 204580 Laufzeit: 7 Minute(n), 19 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 19 HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\delta LTD (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DELTA\DELTA\IESTRG (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\babylontoolbar (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\DomaIQ (PUP.Optional.DomaIQ.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\IMINENT (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 7 HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://www2.delta-search.com/?affID=120519&tt=gc_&babsrc=HP_ss&mntrId=382D001B38D067D9 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Delta\delta|lastB (PUP.Optional.Delta.A) -> Daten: hxxp://www2.delta-search.com/?affID=119556&tt=gc_&babsrc=HP_ss&mntrId=382D001B38D067D9 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Delta\delta\iestrg|tlbrsrchurl (PUP.Optional.Delta.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|bProtectTabs (PUP.Optional.BrowserProtect.A) -> Daten: hxxp://www2.delta-search.com/?affID=120519&tt=gc_&babsrc=HP_ss&mntrId=382D001B38D067D9 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\Software\Iminent|RefererId (PUP.Optional.Iminent.A) -> Daten: 698 -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 1 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.StartPage) -> Bösartig: (hxxp://www2.delta-search.com/?affID=120519&tt=gc_&babsrc=HP_ss&mntrId=382D001B38D067D9) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 5 C:\Users\Tobias\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\Delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 9 C:\Users\Tobias\AppData\Roaming\BabSolution\Shared\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\Babylon\SUDump.dmp (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\Delta\sqlite3.dll (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\BabSolution\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\BabSolution\Shared\GUninstaller.exe (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Tobias\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) frst FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Tobias (administrator) on CHRISTIAN-BÜRO on 06-10-2013 20:06:46
Running from C:\Users\Tobias\Desktop\Dateien\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(HiTRUST) C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
(CyberLink) C:\Acer\Empowering Technology\eAudio\eAudio.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(HiTRSUT) C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
(Acer Inc.) C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Realtek Semiconductor Corp.) C:\Users\Tobias\AppData\Local\Temp\RtkBtMnt.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
() C:\Program Files\Tor\tor.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor)
HKLM\...\Run: [eDataSecurity Loader] - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [457216 2007-04-25] (HiTRUST)
HKLM\...\Run: [eAudio] - C:\Acer\Empowering Technology\eAudio\eAudio.exe [1286144 2007-06-11] (CyberLink)
HKLM\...\Run: [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe [772616 2007-08-15] (Dritek System Inc.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [WarReg_PopUp] - C:\Acer\WR_PopUp\WarReg_PopUp.exe [57344 2006-11-05] (Acer Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [55824 2007-09-21] (Logitech, Inc.)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [111936 2008-11-07] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2009-01-05] (Apple Inc.)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] - RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [Microsoft Default Manager] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339312 2010-09-15] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-04-26] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {380002C7-37D5-4958-8D38-62D386438EFB} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {77AA3134-D51A-43F7-A4BF-4859267C1B14} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
Toolbar: HKCU -Acer eDataSecurity Management - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} hxxp://www.lokalisten.de/iup/ImageUploader4.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\search-results.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: gui:config - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\guiconfig@slosd.net
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\trackerblock@privacychoice.org
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Docs) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Happy Lyrics) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj\1.111_0
CHR HKLM\...\Chrome\Extension: [ealchnonpofjocgofjpopjdoegbbkofj] - C:\Program Files\HappyLyrics\Chrome.crx
========================== Services (Whitelisted) =================
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-04-25] (HiTRSUT)
R2 eLockService; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [24576 2007-04-23] (Acer Inc.)
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-06-13] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-07-03] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-06-28] ()
S3 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2010-10-25] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 tor; C:\Program Files\Tor\tor.exe [3233806 2013-09-05] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [167936 2007-09-14] (acer)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
==================== Drivers (Whitelisted) ====================
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R1 DritekPortIO; C:\PROGRA~1\LAUNCH~1\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
S3 dsiarhwprog; C:\Windows\System32\Drivers\dsiarhwprog.sys [29184 2007-02-08] (Thesycon GmbH, Germany)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [25280 2008-04-10] (LogMeIn, Inc.)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20776 2007-04-25] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-04-25] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-04-25] (HiTRUST)
S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [83880 2007-12-10] (MCCI Corporation)
S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [15016 2007-12-10] (MCCI Corporation)
S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [110632 2007-12-10] (MCCI Corporation)
S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [104616 2007-12-10] (MCCI Corporation)
S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [25512 2007-12-10] (MCCI Corporation)
S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [100648 2007-12-10] (MCCI Corporation)
S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [110120 2007-12-10] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Tobias\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 LVRS; system32\DRIVERS\lvrs.sys [x]
S3 LVUSBSta; system32\drivers\LVUSBSta.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S3 PID_PEPI; system32\DRIVERS\LV302V32.SYS [x]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-06 20:03 - 2013-10-06 20:03 - 00001258 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-10-06 19:58 - 2013-10-06 19:58 - 00000000 ____D C:\Windows\ERUNT
2013-10-06 19:56 - 2013-10-06 19:56 - 00018408 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-10-06 19:51 - 2013-10-06 19:53 - 00000000 ____D C:\AdwCleaner
2013-10-06 19:27 - 2013-10-06 19:27 - 01032220 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-10-06 19:27 - 2013-10-06 19:27 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-06 19:27 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-06 19:26 - 2013-10-06 19:26 - 01045226 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-10-06 14:57 - 2013-10-06 19:55 - 00000442 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-05 12:42 - 2013-10-05 12:42 - 00013128 _____ C:\ComboFix.txt
2013-10-05 12:28 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-05 12:28 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-05 12:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-05 12:19 - 2013-10-05 12:42 - 00000000 ____D C:\Qoobox
2013-10-05 12:19 - 2013-10-05 12:41 - 00000000 ____D C:\Windows\erdnt
2013-10-05 12:18 - 2013-10-05 12:19 - 05130782 ____R (Swearware) C:\Users\Tobias\Desktop\ComboFix.exe
2013-10-04 21:19 - 2013-10-04 21:19 - 00000000 ____D C:\FRST
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-02 10:33 - 2013-10-02 10:34 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-19 21:26 - 2013-09-19 21:41 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-11 17:57 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 17:57 - 2013-08-01 12:21 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 17:57 - 2013-08-01 12:20 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 17:57 - 2013-08-01 12:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-11 17:57 - 2013-08-01 12:18 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 06016512 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 11111936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 02005504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-11 17:57 - 2013-08-01 12:15 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 17:57 - 2013-08-01 12:13 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2013-09-11 17:57 - 2013-08-01 10:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-09-11 17:57 - 2013-08-01 08:56 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 17:57 - 2013-08-01 08:56 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-11 17:57 - 2013-08-01 08:55 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-09-11 17:57 - 2013-08-01 08:54 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 17:57 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-09-06 19:41 - 2013-09-06 19:41 - 96462459 _____ C:\Windows\system32\宝幇ᰔž
==================== One Month Modified Files and Folders =======
2013-10-06 20:03 - 2013-10-06 20:03 - 00001258 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-10-06 20:03 - 2006-11-02 12:33 - 01445352 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-06 20:00 - 2008-02-25 16:03 - 01766363 _____ C:\Windows\WindowsUpdate.log
2013-10-06 19:58 - 2013-10-06 19:58 - 00000000 ____D C:\Windows\ERUNT
2013-10-06 19:56 - 2013-10-06 19:56 - 00018408 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-10-06 19:56 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.001
2013-10-06 19:55 - 2013-10-06 14:57 - 00000442 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-06 19:55 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.dat
2013-10-06 19:55 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-06 19:55 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-06 19:53 - 2013-10-06 19:51 - 00000000 ____D C:\AdwCleaner
2013-10-06 19:52 - 2009-07-31 12:41 - 00000000 ____D C:\ProgramData\ICQ
2013-10-06 19:48 - 2007-07-28 12:05 - 00712490 _____ C:\Windows\PFRO.log
2013-10-06 19:46 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\nap
2013-10-06 19:27 - 2013-10-06 19:27 - 01032220 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-10-06 19:27 - 2013-10-06 19:27 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-06 19:26 - 2013-10-06 19:26 - 01045226 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-10-06 14:55 - 2008-04-26 17:42 - 00006944 _____ C:\Users\Tobias\AppData\Local\d3d9caps.dat
2013-10-05 12:42 - 2013-10-05 12:42 - 00013128 _____ C:\ComboFix.txt
2013-10-05 12:42 - 2013-10-05 12:19 - 00000000 ____D C:\Qoobox
2013-10-05 12:42 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2013-10-05 12:42 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-10-05 12:41 - 2013-10-05 12:19 - 00000000 ____D C:\Windows\erdnt
2013-10-05 12:39 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-10-05 12:19 - 2013-10-05 12:18 - 05130782 ____R (Swearware) C:\Users\Tobias\Desktop\ComboFix.exe
2013-10-04 21:19 - 2013-10-04 21:19 - 00000000 ____D C:\FRST
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-04 21:18 - 2008-03-23 17:08 - 00000000 ____D C:\Users\Tobias
2013-10-04 09:21 - 2012-05-08 16:12 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-02 10:34 - 2013-10-02 10:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-28 22:09 - 2008-03-25 19:08 - 00007292 _____ C:\Users\Tobias\AppData\Roaming\wklnhst.dat
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-25 08:57 - 2006-11-02 14:52 - 00120082 _____ C:\Windows\setupact.log
2013-09-19 21:41 - 2013-09-19 21:26 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-17 22:14 - 2008-03-28 17:27 - 00023552 _____ C:\Users\Tobias\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-16 19:04 - 2013-06-27 18:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-16 19:04 - 2013-06-27 18:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-16 19:04 - 2012-04-22 13:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-14 20:26 - 2007-07-28 11:46 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 18:19 - 2006-11-02 14:47 - 00392680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 18:07 - 2013-07-14 21:43 - 00000000 ____D C:\Windows\system32\MRT
2013-09-11 18:04 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-09-06 20:17 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-06 19:41 - 2013-09-06 19:41 - 96462459 _____ C:\Windows\system32\宝幇ᰔž
2013-09-06 19:39 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\temp\catchme.dll
C:\Users\Tobias\AppData\Local\temp\Quarantine.exe
C:\Users\Tobias\AppData\Local\temp\RtkBtMnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-06 20:04
==================== End Of Log ============================
|
|
07.10.2013, 09:32
| #6 |
| /// the machine /// TB-Ausbilder | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem ForumESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum |
|
07.10.2013, 12:46
| #7 |
| | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum Hier die logs eset Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7cf527f6d2b4f2408993b83b27dccdc4
# engine=15383
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-07 10:42:47
# local_time=2013-10-07 12:42:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 270820 218675295 0 0
# scanned=172068
# found=2
# cleaned=0
# scan_time=6577
sh=C613A77B328D1EF954E0EE3125B3199A44EE23E1 ft=1 fh=2238719fe783feda vn="a variant of Win32/Adware.AddLyrics.I application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\HappyLyrics\HLUpdater.exe.vir"
sh=B3EA248D85095B8B2D3D8E1A8F29A429FA74E7A0 ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.F application" ac=I fn="C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj\1.111_0\contentscript.js"
security check Code:
ATTFilter Results of screen317's Security Check version 0.99.74
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 8 Out of date!
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 14
Java(TM) 6 Update 37
Java 7 Update 25
Java version out of Date!
Adobe Flash Player 11.8.800.168
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader 10.1.8 Adobe Reader out of Date!
Mozilla Firefox (24.0)
Mozilla Thunderbird (17.0.8)
````````Process Check: objlist.exe by Laurent````````
Empowering Technology eSettings Service capuserv.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Tobias (administrator) on CHRISTIAN-BÜRO on 07-10-2013 13:45:41
Running from C:\Users\Tobias\Desktop\Dateien\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(HiTRSUT) C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
(Acer Inc.) C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
() C:\Program Files\Tor\tor.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(HiTRUST) C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
(CyberLink) C:\Acer\Empowering Technology\eAudio\eAudio.exe
(Realtek Semiconductor Corp.) C:\Users\Tobias\AppData\Local\Temp\RtkBtMnt.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor)
HKLM\...\Run: [eDataSecurity Loader] - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [457216 2007-04-25] (HiTRUST)
HKLM\...\Run: [eAudio] - C:\Acer\Empowering Technology\eAudio\eAudio.exe [1286144 2007-06-11] (CyberLink)
HKLM\...\Run: [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe [772616 2007-08-15] (Dritek System Inc.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [WarReg_PopUp] - C:\Acer\WR_PopUp\WarReg_PopUp.exe [57344 2006-11-05] (Acer Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [55824 2007-09-21] (Logitech, Inc.)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [111936 2008-11-07] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2009-01-05] (Apple Inc.)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] - RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [Microsoft Default Manager] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339312 2010-09-15] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-04-26] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {380002C7-37D5-4958-8D38-62D386438EFB} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {77AA3134-D51A-43F7-A4BF-4859267C1B14} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
Toolbar: HKCU -Acer eDataSecurity Management - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} hxxp://www.lokalisten.de/iup/ImageUploader4.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\search-results.xml
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: gui:config - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\guiconfig@slosd.net
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\trackerblock@privacychoice.org
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\nwe002l6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Docs) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Happy Lyrics) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj\1.111_0
CHR HKLM\...\Chrome\Extension: [ealchnonpofjocgofjpopjdoegbbkofj] - C:\Program Files\HappyLyrics\Chrome.crx
========================== Services (Whitelisted) =================
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-04-25] (HiTRSUT)
R2 eLockService; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [24576 2007-04-23] (Acer Inc.)
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-06-13] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-07-03] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-06-28] ()
S3 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2010-10-25] ()
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 tor; C:\Program Files\Tor\tor.exe [3233806 2013-09-05] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [167936 2007-09-14] (acer)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
==================== Drivers (Whitelisted) ====================
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R1 DritekPortIO; C:\PROGRA~1\LAUNCH~1\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
S3 dsiarhwprog; C:\Windows\System32\Drivers\dsiarhwprog.sys [29184 2007-02-08] (Thesycon GmbH, Germany)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [25280 2008-04-10] (LogMeIn, Inc.)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20776 2007-04-25] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-04-25] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-04-25] (HiTRUST)
S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [83880 2007-12-10] (MCCI Corporation)
S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [15016 2007-12-10] (MCCI Corporation)
S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [110632 2007-12-10] (MCCI Corporation)
S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [104616 2007-12-10] (MCCI Corporation)
S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [25512 2007-12-10] (MCCI Corporation)
S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [100648 2007-12-10] (MCCI Corporation)
S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [110120 2007-12-10] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Tobias\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 LVRS; system32\DRIVERS\lvrs.sys [x]
S3 LVUSBSta; system32\drivers\LVUSBSta.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S3 PID_PEPI; system32\DRIVERS\LV302V32.SYS [x]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-07 10:47 - 2013-10-07 10:47 - 00891167 _____ C:\Users\Tobias\Desktop\SecurityCheck.exe
2013-10-07 10:46 - 2013-10-07 10:46 - 02347384 _____ (ESET) C:\Users\Tobias\Desktop\esetsmartinstaller_enu.exe
2013-10-06 20:03 - 2013-10-06 20:03 - 00001258 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-10-06 19:58 - 2013-10-06 19:58 - 00000000 ____D C:\Windows\ERUNT
2013-10-06 19:56 - 2013-10-06 19:56 - 00018408 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-10-06 19:51 - 2013-10-06 19:53 - 00000000 ____D C:\AdwCleaner
2013-10-06 19:27 - 2013-10-06 19:27 - 01032220 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 19:26 - 2013-10-06 19:26 - 01045226 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-10-06 14:57 - 2013-10-07 10:44 - 00000440 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-05 12:42 - 2013-10-05 12:42 - 00013128 _____ C:\ComboFix.txt
2013-10-05 12:28 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-05 12:28 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-05 12:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-05 12:19 - 2013-10-05 12:42 - 00000000 ____D C:\Qoobox
2013-10-05 12:19 - 2013-10-05 12:41 - 00000000 ____D C:\Windows\erdnt
2013-10-05 12:18 - 2013-10-05 12:19 - 05130782 ____R (Swearware) C:\Users\Tobias\Desktop\ComboFix.exe
2013-10-04 21:19 - 2013-10-04 21:19 - 00000000 ____D C:\FRST
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-02 10:33 - 2013-10-02 10:34 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-19 21:26 - 2013-09-19 21:41 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-11 17:57 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 17:57 - 2013-08-01 12:21 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 17:57 - 2013-08-01 12:20 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 17:57 - 2013-08-01 12:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-11 17:57 - 2013-08-01 12:18 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 06016512 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-11 17:57 - 2013-08-01 12:16 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 11111936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 02005504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-11 17:57 - 2013-08-01 12:15 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-09-11 17:57 - 2013-08-01 12:15 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 17:57 - 2013-08-01 12:13 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2013-09-11 17:57 - 2013-08-01 10:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-09-11 17:57 - 2013-08-01 08:56 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 17:57 - 2013-08-01 08:56 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-11 17:57 - 2013-08-01 08:55 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-09-11 17:57 - 2013-08-01 08:54 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 17:57 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
==================== One Month Modified Files and Folders =======
2013-10-07 12:43 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 12:43 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:51 - 2008-02-25 16:03 - 01779409 _____ C:\Windows\WindowsUpdate.log
2013-10-07 10:49 - 2006-11-02 12:33 - 01445352 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-07 10:47 - 2013-10-07 10:47 - 00891167 _____ C:\Users\Tobias\Desktop\SecurityCheck.exe
2013-10-07 10:46 - 2013-10-07 10:46 - 02347384 _____ (ESET) C:\Users\Tobias\Desktop\esetsmartinstaller_enu.exe
2013-10-07 10:44 - 2013-10-06 14:57 - 00000440 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-07 10:44 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.001
2013-10-07 10:43 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.dat
2013-10-06 20:03 - 2013-10-06 20:03 - 00001258 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-10-06 19:58 - 2013-10-06 19:58 - 00000000 ____D C:\Windows\ERUNT
2013-10-06 19:56 - 2013-10-06 19:56 - 00018408 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-10-06 19:53 - 2013-10-06 19:51 - 00000000 ____D C:\AdwCleaner
2013-10-06 19:52 - 2009-07-31 12:41 - 00000000 ____D C:\ProgramData\ICQ
2013-10-06 19:48 - 2007-07-28 12:05 - 00712490 _____ C:\Windows\PFRO.log
2013-10-06 19:48 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\nap
2013-10-06 19:27 - 2013-10-06 19:27 - 01032220 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 19:26 - 2013-10-06 19:26 - 01045226 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-10-06 15:12 - 2013-01-11 10:53 - 00000000 ____D C:\ProgramData\Avira
2013-10-06 14:55 - 2008-04-26 17:42 - 00006944 _____ C:\Users\Tobias\AppData\Local\d3d9caps.dat
2013-10-05 12:42 - 2013-10-05 12:42 - 00013128 _____ C:\ComboFix.txt
2013-10-05 12:42 - 2013-10-05 12:19 - 00000000 ____D C:\Qoobox
2013-10-05 12:42 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2013-10-05 12:42 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-10-05 12:41 - 2013-10-05 12:19 - 00000000 ____D C:\Windows\erdnt
2013-10-05 12:39 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-10-05 12:19 - 2013-10-05 12:18 - 05130782 ____R (Swearware) C:\Users\Tobias\Desktop\ComboFix.exe
2013-10-04 21:19 - 2013-10-04 21:19 - 00000000 ____D C:\FRST
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-04 21:18 - 2008-03-23 17:08 - 00000000 ____D C:\Users\Tobias
2013-10-04 09:21 - 2012-05-08 16:12 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-02 10:34 - 2013-10-02 10:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-28 22:09 - 2008-03-25 19:08 - 00007292 _____ C:\Users\Tobias\AppData\Roaming\wklnhst.dat
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-25 08:57 - 2006-11-02 14:52 - 00120082 _____ C:\Windows\setupact.log
2013-09-19 21:41 - 2013-09-19 21:26 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-17 22:14 - 2008-03-28 17:27 - 00023552 _____ C:\Users\Tobias\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-16 19:04 - 2013-06-27 18:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-16 19:04 - 2013-06-27 18:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-16 19:04 - 2012-04-22 13:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-14 20:26 - 2007-07-28 11:46 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 18:19 - 2006-11-02 14:47 - 00392680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 18:07 - 2013-07-14 21:43 - 00000000 ____D C:\Windows\system32\MRT
2013-09-11 18:04 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\temp\catchme.dll
C:\Users\Tobias\AppData\Local\temp\Quarantine.exe
C:\Users\Tobias\AppData\Local\temp\RtkBtMnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-07 10:56
==================== End Of Log ============================
--- --- --- |
|
08.10.2013, 07:26
| #8 |
| /// the machine /// TB-Ausbilder | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum Java und Adobe updaten, unbedingt WIndows updaten. Chrome deinstallieren und neu installieren, keine Daten behalten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter R2 tor; C:\Program Files\Tor\tor.exe [3233806 2013-09-05] ()
C:\Program Files\Tor
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Rechner neu starten. Frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.10.2013, 10:14
| #9 |
| | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Tobias (administrator) on CHRISTIAN-BÜRO on 08-10-2013 11:10:58
Running from C:\Users\Tobias\Desktop\Dateien\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(HiTRSUT) C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
(Acer Inc.) C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(HiTRUST) C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
(CyberLink) C:\Acer\Empowering Technology\eAudio\eAudio.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Lexware GmbH & Co. KG) C:\Program Files\Common Files\Lexware\LxWebAccess\LxWebAccess.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
(Realtek Semiconductor Corp.) C:\Users\Tobias\AppData\Local\Temp\RtkBtMnt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4669440 2007-07-06] (Realtek Semiconductor)
HKLM\...\Run: [eDataSecurity Loader] - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [457216 2007-04-25] (HiTRUST)
HKLM\...\Run: [eAudio] - C:\Acer\Empowering Technology\eAudio\eAudio.exe [1286144 2007-06-11] (CyberLink)
HKLM\...\Run: [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe [772616 2007-08-15] (Dritek System Inc.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [WarReg_PopUp] - C:\Acer\WR_PopUp\WarReg_PopUp.exe [57344 2006-11-05] (Acer Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [55824 2007-09-21] (Logitech, Inc.)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [111936 2008-11-07] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2009-01-05] (Apple Inc.)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-06-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] - RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [Microsoft Default Manager] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339312 2010-09-15] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\Acer\run_NB.exe [ 2007-04-26] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {380002C7-37D5-4958-8D38-62D386438EFB} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
Toolbar: HKCU -Acer eDataSecurity Management - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} hxxp://www.lokalisten.de/iup/ImageUploader4.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\9rw5cklh.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Docs) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Happy Lyrics) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj\1.111_0
CHR HKLM\...\Chrome\Extension: [ealchnonpofjocgofjpopjdoegbbkofj] - C:\Program Files\HappyLyrics\Chrome.crx
========================== Services (Whitelisted) =================
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-04-25] (HiTRSUT)
R2 eLockService; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [24576 2007-04-23] (Acer Inc.)
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-06-13] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-07-03] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-06-28] ()
S3 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2010-10-25] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [167936 2007-09-14] (acer)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
==================== Drivers (Whitelisted) ====================
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R1 DritekPortIO; C:\PROGRA~1\LAUNCH~1\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
S3 dsiarhwprog; C:\Windows\System32\Drivers\dsiarhwprog.sys [29184 2007-02-08] (Thesycon GmbH, Germany)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [25280 2008-04-10] (LogMeIn, Inc.)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20776 2007-04-25] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-04-25] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-04-25] (HiTRUST)
S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [83880 2007-12-10] (MCCI Corporation)
S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [15016 2007-12-10] (MCCI Corporation)
S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [110632 2007-12-10] (MCCI Corporation)
S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [104616 2007-12-10] (MCCI Corporation)
S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [25512 2007-12-10] (MCCI Corporation)
S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [100648 2007-12-10] (MCCI Corporation)
S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [110120 2007-12-10] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Tobias\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 LVRS; system32\DRIVERS\lvrs.sys [x]
S3 LVUSBSta; system32\drivers\LVUSBSta.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pepifilter; system32\DRIVERS\lv302af.sys [x]
S3 PID_PEPI; system32\DRIVERS\LV302V32.SYS [x]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-08 11:09 - 2013-10-08 11:09 - 00000953 _____ C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-10-08 10:53 - 2013-10-08 10:53 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-10-08 10:53 - 2013-10-08 10:53 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-08 10:53 - 2013-10-08 10:53 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-08 10:53 - 2013-10-08 10:53 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-10-08 10:53 - 2013-10-08 10:53 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-10-08 10:53 - 2013-10-08 10:53 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00000850 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-08 10:43 - 2013-10-08 10:43 - 00000000 ____D C:\ProgramData\Oracle
2013-10-08 10:43 - 2013-10-08 10:43 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-08 10:42 - 2013-10-08 10:42 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-08 10:42 - 2013-10-08 10:42 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-08 10:42 - 2013-10-08 10:42 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-08 10:42 - 2013-10-08 10:42 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-08 10:38 - 2013-10-08 10:38 - 00001951 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-08 10:38 - 2013-10-08 10:38 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-08 10:38 - 2013-10-08 10:38 - 00000000 ____D C:\ProgramData\McAfee
2013-10-08 10:38 - 2013-10-08 10:38 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-07 10:47 - 2013-10-07 10:47 - 00891167 _____ C:\Users\Tobias\Desktop\SecurityCheck.exe
2013-10-07 10:46 - 2013-10-07 10:46 - 02347384 _____ (ESET) C:\Users\Tobias\Desktop\esetsmartinstaller_enu.exe
2013-10-06 20:03 - 2013-10-06 20:03 - 00001258 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-10-06 19:58 - 2013-10-06 19:58 - 00000000 ____D C:\Windows\ERUNT
2013-10-06 19:56 - 2013-10-06 19:56 - 00018408 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-10-06 19:51 - 2013-10-06 19:53 - 00000000 ____D C:\AdwCleaner
2013-10-06 19:27 - 2013-10-06 19:27 - 01032220 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 19:26 - 2013-10-06 19:26 - 01045226 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-10-06 14:57 - 2013-10-08 11:08 - 00000439 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-05 12:42 - 2013-10-05 12:42 - 00013128 _____ C:\ComboFix.txt
2013-10-05 12:28 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-05 12:28 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-05 12:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-05 12:28 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-05 12:19 - 2013-10-05 12:42 - 00000000 ____D C:\Qoobox
2013-10-05 12:19 - 2013-10-05 12:41 - 00000000 ____D C:\Windows\erdnt
2013-10-05 12:18 - 2013-10-05 12:19 - 05130782 ____R (Swearware) C:\Users\Tobias\Desktop\ComboFix.exe
2013-10-04 21:19 - 2013-10-08 11:03 - 00000000 ____D C:\FRST
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-02 10:33 - 2013-10-08 10:53 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-19 21:26 - 2013-09-19 21:41 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-11 17:57 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 17:57 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
==================== One Month Modified Files and Folders =======
2013-10-08 11:10 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.001
2013-10-08 11:09 - 2013-10-08 11:09 - 00000953 _____ C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-10-08 11:08 - 2013-10-06 14:57 - 00000439 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-08 11:07 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-08 11:07 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-08 11:06 - 2012-05-08 16:12 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-08 11:04 - 2008-02-25 16:03 - 01824344 _____ C:\Windows\WindowsUpdate.log
2013-10-08 11:04 - 2006-11-02 13:18 - 00000000 ___RD C:\Windows\Offline Web Pages
2013-10-08 11:04 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-08 11:03 - 2013-10-04 21:19 - 00000000 ____D C:\FRST
2013-10-08 10:56 - 2011-06-01 20:44 - 00005594 _____ C:\Windows\IE9_main.log
2013-10-08 10:54 - 2006-11-02 08:32 - 00008798 _____ C:\Windows\system32\icrav03.rat
2013-10-08 10:54 - 2006-11-02 08:32 - 00001988 _____ C:\Windows\system32\ticrf.rat
2013-10-08 10:53 - 2013-10-08 10:53 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-10-08 10:53 - 2013-10-08 10:53 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-08 10:53 - 2013-10-08 10:53 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-08 10:53 - 2013-10-08 10:53 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-10-08 10:53 - 2013-10-08 10:53 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-10-08 10:53 - 2013-10-08 10:53 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-10-08 10:53 - 2013-10-08 10:53 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-10-08 10:53 - 2013-10-08 10:53 - 00000850 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-08 10:53 - 2013-10-02 10:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-08 10:43 - 2013-10-08 10:43 - 00000000 ____D C:\ProgramData\Oracle
2013-10-08 10:43 - 2013-10-08 10:43 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-08 10:42 - 2013-10-08 10:42 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-08 10:42 - 2013-10-08 10:42 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-08 10:42 - 2013-10-08 10:42 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-08 10:42 - 2013-10-08 10:42 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-08 10:42 - 2012-07-08 20:23 - 00868264 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2013-10-08 10:42 - 2010-06-08 20:13 - 00790440 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-10-08 10:42 - 2009-08-10 19:26 - 00000000 ____D C:\Program Files\Java
2013-10-08 10:38 - 2013-10-08 10:38 - 00001951 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-08 10:38 - 2013-10-08 10:38 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-08 10:38 - 2013-10-08 10:38 - 00000000 ____D C:\ProgramData\McAfee
2013-10-08 10:38 - 2013-10-08 10:38 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-08 10:38 - 2008-03-24 23:41 - 00000000 ____D C:\Users\Tobias\AppData\Local\Adobe
2013-10-08 10:37 - 2006-11-02 12:33 - 01445352 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-08 10:31 - 2009-05-06 18:28 - 00027934 _____ C:\ProgramData\nvModes.dat
2013-10-08 10:30 - 2007-07-28 12:05 - 00713288 _____ C:\Windows\PFRO.log
2013-10-07 10:47 - 2013-10-07 10:47 - 00891167 _____ C:\Users\Tobias\Desktop\SecurityCheck.exe
2013-10-07 10:46 - 2013-10-07 10:46 - 02347384 _____ (ESET) C:\Users\Tobias\Desktop\esetsmartinstaller_enu.exe
2013-10-06 20:03 - 2013-10-06 20:03 - 00001258 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-10-06 19:58 - 2013-10-06 19:58 - 00000000 ____D C:\Windows\ERUNT
2013-10-06 19:56 - 2013-10-06 19:56 - 00018408 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-10-06 19:53 - 2013-10-06 19:51 - 00000000 ____D C:\AdwCleaner
2013-10-06 19:52 - 2009-07-31 12:41 - 00000000 ____D C:\ProgramData\ICQ
2013-10-06 19:48 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\nap
2013-10-06 19:27 - 2013-10-06 19:27 - 01032220 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-10-06 19:27 - 2013-10-06 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 19:26 - 2013-10-06 19:26 - 01045226 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-10-06 15:12 - 2013-01-11 10:53 - 00000000 ____D C:\ProgramData\Avira
2013-10-06 14:55 - 2008-04-26 17:42 - 00006944 _____ C:\Users\Tobias\AppData\Local\d3d9caps.dat
2013-10-05 12:42 - 2013-10-05 12:42 - 00013128 _____ C:\ComboFix.txt
2013-10-05 12:42 - 2013-10-05 12:19 - 00000000 ____D C:\Qoobox
2013-10-05 12:42 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2013-10-05 12:42 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-10-05 12:41 - 2013-10-05 12:19 - 00000000 ____D C:\Windows\erdnt
2013-10-05 12:39 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-10-05 12:19 - 2013-10-05 12:18 - 05130782 ____R (Swearware) C:\Users\Tobias\Desktop\ComboFix.exe
2013-10-04 21:18 - 2013-10-04 21:18 - 00000000 _____ C:\Users\Tobias\defogger_reenable
2013-10-04 21:18 - 2008-03-23 17:08 - 00000000 ____D C:\Users\Tobias
2013-09-28 22:09 - 2008-03-25 19:08 - 00007292 _____ C:\Users\Tobias\AppData\Roaming\wklnhst.dat
2013-09-26 15:21 - 2013-09-26 15:21 - 97961477 _____ C:\Windows\system32\ᮼ뢍ᰔ
2013-09-25 08:57 - 2006-11-02 14:52 - 00120082 _____ C:\Windows\setupact.log
2013-09-19 21:41 - 2013-09-19 21:26 - 00010518 _____ C:\Users\Tobias\Documents\Auslagen Videx.xlsx
2013-09-17 22:14 - 2008-03-28 17:27 - 00023552 _____ C:\Users\Tobias\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-16 19:04 - 2013-06-27 18:35 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-16 19:04 - 2013-06-27 18:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-16 19:04 - 2012-04-22 13:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-14 20:26 - 2007-07-28 11:46 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 18:19 - 2006-11-02 14:47 - 00392680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 18:07 - 2013-07-14 21:43 - 00000000 ____D C:\Windows\system32\MRT
2013-09-11 18:04 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\temp\catchme.dll
C:\Users\Tobias\AppData\Local\temp\Quarantine.exe
C:\Users\Tobias\AppData\Local\temp\RtkBtMnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-08 11:12
==================== End Of Log ============================
fixlog Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by Tobias at 2013-10-08 11:03:50 Run:1
Running from C:\Users\Tobias\Desktop\Dateien\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
R2 tor; C:\Program Files\Tor\tor.exe [3233806 2013-09-05] ()
C:\Program Files\Tor
*****************
tor => Service deleted successfully.
C:\Program Files\Tor => Moved successfully.
The system needs a manual reboot.
==== End of Fixlog ====
Java und Windows sind up-to-date. - Adobe ebenso. |
|
08.10.2013, 12:56
| #10 |
| /// the machine /// TB-Ausbilder | Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum Fertig Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows Vista Sicherheitscenter und AntiVir nach Neustart immer abgeschaltet - Bereits bekanntes Phänomen in Eurem Forum |
| computer, desktop, farbar, farbar recovery scan tool, flash player, homepage, newtab, ntdll.dll, officejet, plug-in, pop-up-blocker, pup.bprotector, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.babylontoolbar.a, pup.optional.bprotector.a, pup.optional.browserprotect.a, pup.optional.datamngr.a, pup.optional.delta.a, pup.optional.domaiq.a, pup.optional.filescout.a, pup.optional.iminent.a, pup.optional.startpage, registry, sicherheitscenter deaktiviert, starten, svchost.exe, symantec, trojan.bho, win32/adware.addlyrics.f, win32/adware.addlyrics.i, windows |
Linear-Darstellung
