| |
| |||||||
Log-Analyse und Auswertung: Win7 Weblayers.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
09.11.2013, 15:10
| #1 |
| |  Win7 Weblayers.exe Hallo zusammen, als ich heute meinen PC angeschaltet habe wurde ich direkt von meinem Antivirus Programm (Avast! Free Antivirus) auf 3 Bedrohungen aufmerksam gemacht. Da ich kaum Erfahrung in der IT-Sicherheit habe, habe ich einfach die Befunde gelöscht. Danach forderte mich Avast auf einen Nuestart zu machen, woraufhin ich zwischen verschd. Optionen wählen sollte. Bsp. 1.Löschen 2.Alle löschen. 3.Reparieren usw. Keiner dieser Optionen war letztendlich möglich und es kam die Meldung, dass keiner dieser Optionen für das Archiv ausführbar wäre. Mir blieb dann nichts anderes übrig als "Ignorieren" zu drücken und das System ganz normal hochzufahren. Anschließend habe ich 3-4 weitere male Systemscans durchgeführt, wobei sich komischerweise die Befunde reduzierten. Von 3 Befunde auf 1 Befund und schließlich auf "keine Befunde". Ich bitte um Überprüfung der Log Dateien. Die Log Dateien von Avast kann ich irgendwie nicht kopieren oder exportieren, habe auch unter Appdata/avast/... nachgeschaut, aber dort sind soviele Dateien aufgelistet, dass ich keine Ahnung habe, welches das Richtige ist. Mir ist auch aufgefallen, dass seit dem 1.10.13 sich im Container ebefanlls ein "WebLayers.exe" Virus befindet, was soll ich am besten mit dem machen? Hier die betroffenen Pfade laut Avast: C/Program Files (x86)/Web Layers/update/4k2yxx5g.5kx.exe C/Program Files (x86)/Web Layers/updateWebLayers.exe C/User/Admin/AppData/Local/Microsoft/Windows/Temporary Internet Files/...update WebLayers.exe Vielen Dank. FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Admin (administrator) on ADMIN-PC on 09-11-2013 13:58:45
Running from C:\Users\Admin\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
==================== Registry (Whitelisted) ==================
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3866624 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2009-06-05] (Analog Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=C23700221553ADA0&affID=119982&tt=280813_ctrl1&tsp=4991
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD13A8B30CE88CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=C23700221553ADA0&affID=119982&tt=280813_ctrl1&tsp=4991
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Web Layers - {976d7863-9e6c-4066-8c67-0993db9de35f} - C:\Program Files (x86)\Web Layers\WebLayersBHO.dll (Web Layers)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\user.js
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\searchplugins\iminent.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
==================== Services (Whitelisted) =================
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2009-06-05] (Andrea Electronics Corporation)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2013-07-25] (ASUSTeK Computer Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2013-07-25] ()
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-25] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-25] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-25] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2013-07-25] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-09 13:58 - 2013-11-09 13:58 - 00000000 ____D C:\FRST
2013-11-09 13:56 - 2013-11-09 13:57 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-11-09 13:56 - 2013-11-09 13:56 - 00000000 _____ C:\Users\Admin\defogger_reenable
2013-11-09 13:31 - 2013-11-09 13:31 - 00377856 _____ C:\Users\Admin\Desktop\gmer_2.1.19163.exe
2013-11-09 13:30 - 2013-11-09 13:30 - 01957098 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-11-09 13:30 - 2013-11-09 13:30 - 00050477 _____ C:\Users\Admin\Desktop\Defogger.exe
2013-11-09 09:51 - 2013-11-09 09:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-02 13:26 - 2013-11-02 13:26 - 260730429 _____ C:\Windows\MEMORY.DMP
2013-11-02 13:26 - 2013-11-02 13:26 - 00285104 _____ C:\Windows\Minidump\110213-26176-01.dmp
2013-11-02 13:26 - 2013-11-02 13:26 - 00000000 ____D C:\Windows\Minidump
2013-10-20 13:33 - 2013-10-20 13:33 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Brother
2013-10-15 19:00 - 2013-10-15 19:00 - 00000425 _____ C:\Windows\BRWMARK.INI
2013-10-15 18:58 - 2013-10-15 18:58 - 00000050 _____ C:\Windows\system32\BRIDF10A.DAT
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Browny02
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Brother
2013-10-15 18:58 - 2010-03-08 12:50 - 00003072 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2S.dll
2013-10-15 18:58 - 2010-02-09 16:11 - 00217088 ____N (brother) C:\Windows\SysWOW64\NSSearch.dll
2013-10-15 18:58 - 2010-02-05 10:42 - 00180224 ____N (Brother Industries, Ltd.) C:\Windows\SysWOW64\BroSNMP.dll
2013-10-15 18:58 - 2007-12-13 21:16 - 00073728 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2.dll
2013-10-15 18:58 - 2007-12-13 21:16 - 00005632 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2L.dll
2013-10-15 18:56 - 2013-10-15 18:56 - 00000000 ____D C:\ProgramData\Brother
2013-10-15 18:51 - 2013-10-15 18:53 - 00013058 _____ C:\Windows\DPINST.LOG
2013-10-15 18:51 - 2012-08-20 05:19 - 01560576 _____ (Brother Industries, Ltd.) C:\Windows\system32\BrWi209c.dll
2013-10-15 18:51 - 2010-01-22 08:52 - 00061440 _____ (Brother Industries Ltd.) C:\Windows\SysWOW64\brprtink.dll
2013-10-15 18:51 - 2009-08-18 11:36 - 00050688 _____ (Brother Industries, Ltd.) C:\Windows\system32\BrUsi09c.dll
2013-10-12 15:50 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-12 15:49 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-12 15:49 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-12 15:49 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-12 15:49 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-12 15:49 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-12 15:49 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-12 10:05 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-12 10:05 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-12 10:05 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 10:05 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 10:05 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-12 10:05 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-12 10:05 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-12 10:05 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-12 10:05 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-12 10:05 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-12 10:05 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-12 10:05 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-12 10:05 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-12 10:05 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-12 10:05 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-12 10:05 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-12 10:05 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-12 10:05 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-12 10:05 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-12 10:05 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-12 10:05 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-12 10:05 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-12 10:05 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-12 10:05 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-10-12 10:05 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-10-12 10:05 - 2012-11-28 23:56 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
==================== One Month Modified Files and Folders =======
2013-11-09 13:58 - 2013-11-09 13:58 - 00000000 ____D C:\FRST
2013-11-09 13:57 - 2013-11-09 13:56 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-11-09 13:56 - 2013-11-09 13:56 - 00000000 _____ C:\Users\Admin\defogger_reenable
2013-11-09 13:56 - 2013-07-25 01:25 - 00000000 ____D C:\Users\Admin
2013-11-09 13:44 - 2013-07-25 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-09 13:31 - 2013-11-09 13:31 - 00377856 _____ C:\Users\Admin\Desktop\gmer_2.1.19163.exe
2013-11-09 13:30 - 2013-11-09 13:30 - 01957098 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-11-09 13:30 - 2013-11-09 13:30 - 00050477 _____ C:\Users\Admin\Desktop\Defogger.exe
2013-11-09 10:18 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-09 10:18 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-09 10:15 - 2011-04-12 08:43 - 00653928 _____ C:\Windows\system32\perfh007.dat
2013-11-09 10:15 - 2011-04-12 08:43 - 00129800 _____ C:\Windows\system32\perfc007.dat
2013-11-09 10:15 - 2009-07-14 06:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-09 10:14 - 2013-07-25 01:19 - 01976636 _____ C:\Windows\WindowsUpdate.log
2013-11-09 10:11 - 2013-08-20 16:57 - 00012249 _____ C:\Windows\setupact.log
2013-11-09 10:11 - 2013-07-25 01:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-09 10:11 - 2013-07-25 01:29 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-09 10:11 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-09 09:51 - 2013-11-09 09:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-09 09:47 - 2013-08-31 19:08 - 00000000 ____D C:\Program Files (x86)\Web Layers
2013-11-09 09:43 - 2013-07-25 01:38 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-11-06 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-05 08:59 - 2013-07-25 14:28 - 00199771 _____ C:\Users\Admin\Desktop\Textdokument.txt
2013-11-02 13:26 - 2013-11-02 13:26 - 260730429 _____ C:\Windows\MEMORY.DMP
2013-11-02 13:26 - 2013-11-02 13:26 - 00285104 _____ C:\Windows\Minidump\110213-26176-01.dmp
2013-11-02 13:26 - 2013-11-02 13:26 - 00000000 ____D C:\Windows\Minidump
2013-10-31 09:04 - 2013-09-03 18:52 - 00007788 _____ C:\Windows\PFRO.log
2013-10-27 22:11 - 2013-07-25 01:49 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2013-10-27 19:44 - 2013-07-25 01:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-27 19:44 - 2013-07-25 01:48 - 00000000 ____D C:\ProgramData\Skype
2013-10-26 18:14 - 2013-07-25 16:32 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-23 21:43 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Documents\*****
2013-10-20 20:59 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-20 20:59 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-20 13:33 - 2013-10-20 13:33 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Brother
2013-10-15 19:00 - 2013-10-15 19:00 - 00000425 _____ C:\Windows\BRWMARK.INI
2013-10-15 18:58 - 2013-10-15 18:58 - 00000050 _____ C:\Windows\system32\BRIDF10A.DAT
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Browny02
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Brother
2013-10-15 18:58 - 2013-07-25 01:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-15 18:56 - 2013-10-15 18:56 - 00000000 ____D C:\ProgramData\Brother
2013-10-15 18:53 - 2013-10-15 18:51 - 00013058 _____ C:\Windows\DPINST.LOG
2013-10-12 20:17 - 2009-07-14 05:45 - 00274464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-12 15:46 - 2013-08-14 12:28 - 00000000 ____D C:\Windows\system32\MRT
2013-10-12 15:44 - 2013-07-25 12:34 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\air1F55.exe
C:\Users\Admin\AppData\Local\Temp\air54E7.exe
C:\Users\Admin\AppData\Local\Temp\air63F1.exe
C:\Users\Admin\AppData\Local\Temp\air7EB3.exe
C:\Users\Admin\AppData\Local\Temp\air9B07.exe
C:\Users\Admin\AppData\Local\Temp\airC5F.exe
C:\Users\Admin\AppData\Local\Temp\airF6F9.exe
C:\Users\Admin\AppData\Local\Temp\dotNetFx40_Client_setup.exe
C:\Users\Admin\AppData\Local\Temp\F6FA_minecraftsetup.exe
C:\Users\Admin\AppData\Local\Temp\FoxyDeal_Setup.exe
C:\Users\Admin\AppData\Local\Temp\IminentSetup-1-.exe
C:\Users\Admin\AppData\Local\Temp\setup.exe
C:\Users\Admin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Admin\AppData\Local\Temp\uninst1.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-31 21:24
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013
Ran by Admin at 2013-11-09 13:59:26
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)
Apple Application Support (x32 Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (x32 Version: 2.1.3.127)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
Bonjour (Version: 3.0.0.10)
Brother MFL-Pro Suite DCP-J315W (x32 Version: 2.0.0.0)
Canon MP Navigator EX 2.1 (x32)
Canon MX320 series MP Drivers
Canon My Printer (x32 Version: 3.0.0)
Canon Utilities Solution Menu (x32)
CCleaner (Version: 3.26)
CDBurnerXP (Version: 4.3.7.2420)
EPU-6 Engine (x32 Version: 1.03.04)
Host OpenAL (ADI) (x32)
iTunes (Version: 11.1.0.126)
Marvell Miniport Driver (x32 Version: 11.10.5.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 25.0)
NVIDIA 3D Vision Controller-Treiber 310.90 (Version: 310.90)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Revo Uninstaller 1.95 (x32 Version: 1.95)
Skype™ 6.7 (x32 Version: 6.7.102)
SoundMAX (x32 Version: 6.10.2.6585)
Web Layers 3.0.0 (Version: 3.0.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)
==================== Restore Points =========================
08-10-2013 09:14:58 Windows Update
12-10-2013 09:05:29 Windows Update
12-10-2013 14:44:30 Windows Update
15-10-2013 17:20:26 Windows Update
15-10-2013 17:58:28 Installiert Brother Software Suite
22-10-2013 18:26:55 Windows Update
26-10-2013 09:07:30 Windows Update
30-10-2013 07:21:29 Windows Update
05-11-2013 16:30:51 Windows Update
09-11-2013 08:53:23 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1737A361-B95D-4062-A26F-347110E9D189} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2010-03-08] (ASUSTeK Computer Inc.)
Task: {2E993954-CAF6-467C-BDA8-A79C90B698B0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-12-19] (Piriform Ltd)
Task: {90E68EE0-D691-4202-915A-5BDB2D5F5C11} - System32\Tasks\{7C6236BA-0DEF-4D94-9264-06027A6A603A} => Firefox.exe hxxp://ui.skype.com/ui/0/6.1.0.129.259/de/abandoninstall?page=tsBing
Task: {DF2E81E6-147A-4986-ABCA-B7D7642E794B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {FACA1147-9B7C-43CB-A018-DD6318E3982C} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-11-09 09:44 - 2013-11-08 19:39 - 02233344 _____ () C:\Program Files\AVAST Software\Avast\defs\13110801\algo.dll
2012-11-28 13:13 - 2012-11-28 13:13 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-11-28 13:13 - 2012-11-28 13:13 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-07-25 01:45 - 2009-04-22 19:20 - 00179712 _____ () C:\Program Files (x86)\ASUS\EPU-6 Engine\ASUSSERVICE.DLL
2013-07-25 01:45 - 2009-08-27 18:41 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-6 Engine\pngio.dll
2013-07-25 01:45 - 2009-08-27 18:41 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-6 Engine\AsSpindownTimeout.dll
2013-11-09 09:51 - 2013-11-09 09:51 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:D346F792
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/09/2013 01:08:22 PM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Volume "(C:)" wurde aufgrund eines Fehlers nicht defragmentiert: Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
Error: (11/09/2013 01:05:34 PM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Volume "(C:)" wurde aufgrund eines Fehlers nicht defragmentiert: Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
Error: (11/09/2013 10:11:14 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/09/2013 09:49:46 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/07/2013 07:59:34 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/06/2013 05:24:44 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/05/2013 05:53:23 PM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Volume "(C:)" wurde aufgrund eines Fehlers nicht defragmentiert: Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
Error: (11/05/2013 05:27:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/05/2013 07:47:26 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/03/2013 03:54:04 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (11/09/2013 09:45:58 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:45:57 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:45:55 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:45:53 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:45:52 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:45:50 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:45:48 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:45:46 AM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Error: (11/09/2013 09:44:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Util Web Layers" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/06/2013 05:22:54 PM) (Source: Disk) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
Microsoft Office Sessions:
=========================
Error: (11/09/2013 01:08:22 PM) (Source: Microsoft-Windows-Defrag)(User: )
Description: (C:)Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
Error: (11/09/2013 01:05:34 PM) (Source: Microsoft-Windows-Defrag)(User: )
Description: (C:)Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
Error: (11/09/2013 10:11:14 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/09/2013 09:49:46 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/07/2013 07:59:34 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/06/2013 05:24:44 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/05/2013 05:53:23 PM) (Source: Microsoft-Windows-Defrag)(User: )
Description: (C:)Die Startoptimierung konnte aufgrund fehlenden Speicherplatzes nicht abgeschlossen werden. (0x89000019)
Error: (11/05/2013 05:27:54 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/05/2013 07:47:26 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/03/2013 03:54:04 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 36%
Total physical RAM: 4095.05 MB
Available physical RAM: 2591.86 MB
Total Pagefile: 8188.29 MB
Available Pagefile: 6488.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:331.45 GB) (Free:208.28 GB) NTFS
Drive d: () (Fixed) (Total:599.97 GB) (Free:587.73 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 5268E88D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=331 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=600 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-09 14:22:40
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD103UJ rev.1AA01113 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Admin\AppData\Local\Temp\aglorpod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800031f6000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 590 fffff800031f602e 19 bytes [01, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[564] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\services.exe[624] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[728] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[804] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[880] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[904] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Windows\System32\svchost.exe[284] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[416] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[484] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[516] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[1172] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1532] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1568] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1804] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Windows\Explorer.EXE[1856] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1952] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe[2036] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe[1192] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Windows\system32\svchost.exe[1484] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2136] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe[2624] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[212] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe[2104] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[2464] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d13b10 5 bytes JMP 000000010021075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d17ac0 5 bytes JMP 00000001002103a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d41430 5 bytes JMP 0000000100210b14
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d41490 5 bytes JMP 0000000100210ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d41570 5 bytes JMP 000000010021163c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d417b0 5 bytes JMP 0000000100211284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d427e0 5 bytes JMP 00000001002119f4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe476e00 5 bytes JMP 000007ff7e491dac
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe476f2c 5 bytes JMP 000007ff7e490ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe477220 5 bytes JMP 000007ff7e491284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe47739c 5 bytes JMP 000007ff7e49163c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe477538 5 bytes JMP 000007ff7e4919f4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe4775e8 5 bytes JMP 000007ff7e4903a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe47790c 5 bytes JMP 000007ff7e49075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3096] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe477ab4 5 bytes JMP 000007ff7e490b14
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d13b10 5 bytes JMP 00000001001f075c
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d17ac0 5 bytes JMP 00000001001f03a4
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d41430 5 bytes JMP 00000001001f0b14
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d41490 5 bytes JMP 00000001001f0ecc
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d41570 5 bytes JMP 00000001001f163c
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d417b0 5 bytes JMP 00000001001f1284
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d427e0 5 bytes JMP 00000001001f19f4
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe476e00 5 bytes JMP 000007ff7e491dac
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe476f2c 5 bytes JMP 000007ff7e490ecc
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe477220 5 bytes JMP 000007ff7e491284
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe47739c 5 bytes JMP 000007ff7e49163c
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe477538 5 bytes JMP 000007ff7e4919f4
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe4775e8 5 bytes JMP 000007ff7e4903a4
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe47790c 5 bytes JMP 000007ff7e49075c
.text C:\Program Files\iPod\bin\iPodService.exe[3376] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe477ab4 5 bytes JMP 000007ff7e490b14
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d13b10 5 bytes JMP 00000001001b075c
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d17ac0 5 bytes JMP 00000001001b03a4
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d41430 5 bytes JMP 00000001001b0b14
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d41490 5 bytes JMP 00000001001b0ecc
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d41570 5 bytes JMP 00000001001b163c
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d417b0 5 bytes JMP 00000001001b1284
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d427e0 5 bytes JMP 00000001001b19f4
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe476e00 5 bytes JMP 000007ff7e491dac
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe476f2c 5 bytes JMP 000007ff7e490ecc
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe477220 5 bytes JMP 000007ff7e491284
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe47739c 5 bytes JMP 000007ff7e49163c
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe477538 5 bytes JMP 000007ff7e4919f4
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe4775e8 5 bytes JMP 000007ff7e4903a4
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe47790c 5 bytes JMP 000007ff7e49075c
.text C:\Windows\system32\SearchIndexer.exe[3624] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe477ab4 5 bytes JMP 000007ff7e490b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3704] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d13b10 5 bytes JMP 000000010038075c
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d17ac0 5 bytes JMP 00000001003803a4
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d41430 5 bytes JMP 0000000100380b14
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d41490 5 bytes JMP 0000000100380ecc
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d41570 5 bytes JMP 000000010038163c
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d417b0 5 bytes JMP 0000000100381284
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d427e0 5 bytes JMP 00000001003819f4
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe476e00 5 bytes JMP 000007ff7e491dac
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe476f2c 5 bytes JMP 000007ff7e490ecc
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe477220 5 bytes JMP 000007ff7e491284
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe47739c 5 bytes JMP 000007ff7e49163c
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe477538 5 bytes JMP 000007ff7e4919f4
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe4775e8 5 bytes JMP 000007ff7e4903a4
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe47790c 5 bytes JMP 000007ff7e49075c
.text C:\Windows\System32\svchost.exe[2796] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe477ab4 5 bytes JMP 000007ff7e490b14
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000076eefac0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000076eefb58 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076eefcb0 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076ef0038 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076ef1920 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000076f0c4dd 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000076f11287 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b71465 2 bytes [B7, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b714bb 2 bytes [B7, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007642ee09 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000076433982 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000076437603 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007643835c 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007644f52b 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076775181 5 bytes JMP 0000000100111014
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076775254 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000767753d5 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000767754c2 5 bytes JMP 0000000100110c0c
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000767755e2 5 bytes JMP 0000000100110e10
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007677567c 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007677589f 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4144] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076775a22 5 bytes JMP 0000000100110600
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d13b10 5 bytes JMP 000000010029075c
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d17ac0 5 bytes JMP 00000001002903a4
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d41430 5 bytes JMP 0000000100290b14
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d41490 5 bytes JMP 0000000100290ecc
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d41570 5 bytes JMP 000000010029163c
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d417b0 5 bytes JMP 0000000100291284
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d427e0 5 bytes JMP 00000001002919f4
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe476e00 5 bytes JMP 000007ff7e491dac
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe476f2c 5 bytes JMP 000007ff7e490ecc
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe477220 5 bytes JMP 000007ff7e491284
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe47739c 5 bytes JMP 000007ff7e49163c
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe477538 5 bytes JMP 000007ff7e4919f4
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe4775e8 5 bytes JMP 000007ff7e4903a4
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe47790c 5 bytes JMP 000007ff7e49075c
.text C:\Windows\System32\svchost.exe[1296] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe477ab4 5 bytes JMP 000007ff7e490b14
.text C:\Windows\system32\AUDIODG.EXE[1812] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 0000000076b2eecd 1 byte [62]
.text C:\Users\Admin\Desktop\gmer_2.1.19163.exe[3668] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075d8a2ba 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [1296:4576] 000007feeec19688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 193
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 2228226
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 193
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 2228226
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
---- EOF - GMER 2.1 ----
|
|
09.11.2013, 17:36
| #2 |
| /// the machine /// TB-Ausbilder    | Win7 Weblayers.exe hi,
__________________Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
09.11.2013, 18:23
| #3 |
| | Win7 Weblayers.exe So bitteschön, hier die neuen Logs.
__________________Malwarebytes Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.09.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16721 Admin :: ADMIN-PC [Administrator] Schutz: Aktiviert 09.11.2013 17:49:36 mbam-log-2013-11-09 (17-49-36).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 221724 Laufzeit: 2 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 20 HKCR\CLSID\{976d7863-9e6c-4066-8c67-0993db9de35f} (PUP.Optional.WebLayers.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{392e0193-4bb3-4f94-9aca-414b7803e687} (PUP.Optional.WebLayers.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{A3F7FF24-4FDE-43AA-989E-554404B37313} (PUP.Optional.WebLayers.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{976D7863-9E6C-4066-8C67-0993DB9DE35F} (PUP.Optional.WebLayers.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{976D7863-9E6C-4066-8C67-0993DB9DE35F} (PUP.Optional.WebLayers.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} (PUP.Optional.BrowseFox.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23} (PUP.Optional.BrowseFox.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\BabSolution\Redir (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 1 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.StartPage) -> Bösartig: (hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=C23700221553ADA0&affID=119982&tt=280813_ctrl1&tsp=4991) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 4 C:\Users\Admin\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\IminentToolbar (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 25 C:\Program Files (x86)\Web Layers\WebLayersBHO.dll (PUP.Optional.WebLayers.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\air7EB3.exe (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\airF6F9.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\IminentSetup-1-.exe (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\810CC30F-BAB0-7891-9BEE-0BF541269058\Latest\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\810CC30F-BAB0-7891-9BEE-0BF541269058\Latest\BExternal.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\810CC30F-BAB0-7891-9BEE-0BF541269058\Latest\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\810CC30F-BAB0-7891-9BEE-0BF541269058\Latest\CrxInstaller.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\810CC30F-BAB0-7891-9BEE-0BF541269058\Latest\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\810CC30F-BAB0-7891-9BEE-0BF541269058\Latest\MyDeltaTB.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\810CC30F-BAB0-7891-9BEE-0BF541269058\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\appCntrl.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\bg.html (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\bg.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\CrmAdpt.dll (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\ct.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\CTB.dll (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\dpk.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\hprtkMsg.htm (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\hprtkMsg.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\json2.min.js (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\logo.png (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\manifest.json (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Google\Chrome\User Data\default\extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0\pref.json (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.011 - Bericht erstellt am 09/11/2013 um 18:03:46
# Updated 03/11/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Admin - ADMIN-PC
# Gestartet von : C:\Users\Admin\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\Admin\AppData\Local\Temp\AirInstaller
Ordner Gelöscht : C:\Users\Admin\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Admin\Documents\PC Health Kit
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\foxydeal.sqlite
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\invalidprefs.js
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\searchplugins\iminent.xml
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\84dddee16eea49
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\FoxyDeal
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16720
-\\ Mozilla Firefox v25.0 (de)
[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\prefs.js ]
[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vy4j077r.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www2.delta-search.com/?babsrc=NT_ss&mntrId=C23700221553ADA0&affID=119982&tt=280813_ctrl1&tsp=4991");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=C23700221553ADA0&affID=119982&tt=280813_ctrl1&tsp=4991");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "c237eb6800000000000000221553ada0");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15948");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.620:08:02");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119982&tt=280813_ctrl1&tsp=4991");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
*************************
AdwCleaner[R0].txt - [9019 octets] - [09/11/2013 18:02:56]
AdwCleaner[S0].txt - [8446 octets] - [09/11/2013 18:03:46]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8506 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Professional x64
Ran by Admin on 09.11.2013 at 18:09:16,38
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\web layers
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-48976199-2684280666-4043200876-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\web layers
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files (x86)\web layers"
~~~ FireFox
Successfully deleted the following from C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\nmghndmj.default-1378037002191\prefs.js
user_pref("extensions.iminent.admin", false);
user_pref("extensions.iminent.aflt", "orgnl");
user_pref("extensions.iminent.appId", "{0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}");
user_pref("extensions.iminent.autoRvrt", "false");
user_pref("extensions.iminent.dfltLng", "");
user_pref("extensions.iminent.excTlbr", false);
user_pref("extensions.iminent.ffxUnstlRst", false);
user_pref("extensions.iminent.id", "c237eb6800000000000000221553ada0");
user_pref("extensions.iminent.instlDay", "15968");
user_pref("extensions.iminent.instlRef", "");
user_pref("extensions.iminent.newTab", false);
user_pref("extensions.iminent.prdct", "iminent");
user_pref("extensions.iminent.prtnrId", "iminent");
user_pref("extensions.iminent.rvrt", "false");
user_pref("extensions.iminent.smplGrp", "none");
user_pref("extensions.iminent.tlbrId", "base");
user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");
user_pref("extensions.iminent.vrsn", "1.8.25.0");
user_pref("extensions.iminent.vrsnTs", "1.8.25.022:13:53");
user_pref("extensions.iminent.vrsni", "1.8.25.0");
user_pref("iminent.LayoutId", "28");
user_pref("iminent.version", "7.36.1.1");
user_pref("iminent.versioning", "{\"CurrentVersion\":\"7.36.1.1\",\"InstallEventCTime\":1379708056492,\"InstallEvent\":\"True\"}");
Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\nmghndmj.default-1378037002191\minidumps [12 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.11.2013 at 18:16:35,25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Admin (administrator) on ADMIN-PC on 09-11-2013 18:17:45
Running from C:\Users\Admin\Desktop\Neuer Ordner
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
==================== Registry (Whitelisted) ==================
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3866624 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2009-06-05] (Analog Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD13A8B30CE88CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2009-06-05] (Andrea Electronics Corporation)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2013-07-25] (ASUSTeK Computer Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2013-07-25] ()
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-25] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-25] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-25] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2013-07-25] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-09 18:16 - 2013-11-09 18:16 - 00002638 _____ C:\Users\Admin\Desktop\JRT.txt
2013-11-09 18:09 - 2013-11-09 18:09 - 00000000 ____D C:\Windows\ERUNT
2013-11-09 18:06 - 2013-11-09 18:06 - 00008762 _____ C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2013-11-09 18:02 - 2013-11-09 18:03 - 00000000 ____D C:\AdwCleaner
2013-11-09 17:47 - 2013-11-09 17:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-09 17:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-09 17:41 - 2013-11-09 17:41 - 01034531 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2013-11-09 17:40 - 2013-11-09 17:40 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-09 17:40 - 2013-11-09 17:40 - 01073262 _____ C:\Users\Admin\Desktop\adwcleaner.exe
2013-11-09 14:22 - 2013-11-09 14:22 - 00065074 _____ C:\Users\Admin\Desktop\Gmer.txt
2013-11-09 14:22 - 2013-11-09 14:22 - 00000000 ____D C:\Users\Admin\Desktop\Neuer Ordner
2013-11-09 13:59 - 2013-11-09 14:07 - 00022259 _____ C:\Users\Admin\Desktop\FRST.txt
2013-11-09 13:59 - 2013-11-09 13:59 - 00012447 _____ C:\Users\Admin\Desktop\Addition.txt
2013-11-09 13:58 - 2013-11-09 13:58 - 00000000 ____D C:\FRST
2013-11-09 13:56 - 2013-11-09 13:57 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-11-09 13:56 - 2013-11-09 13:56 - 00000000 _____ C:\Users\Admin\defogger_reenable
2013-11-09 09:51 - 2013-11-09 09:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-02 13:26 - 2013-11-02 13:26 - 260730429 _____ C:\Windows\MEMORY.DMP
2013-11-02 13:26 - 2013-11-02 13:26 - 00285104 _____ C:\Windows\Minidump\110213-26176-01.dmp
2013-11-02 13:26 - 2013-11-02 13:26 - 00000000 ____D C:\Windows\Minidump
2013-10-20 13:33 - 2013-10-20 13:33 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Brother
2013-10-15 19:00 - 2013-10-15 19:00 - 00000425 _____ C:\Windows\BRWMARK.INI
2013-10-15 18:58 - 2013-10-15 18:58 - 00000050 _____ C:\Windows\system32\BRIDF10A.DAT
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Browny02
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Brother
2013-10-15 18:58 - 2010-03-08 12:50 - 00003072 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2S.dll
2013-10-15 18:58 - 2010-02-09 16:11 - 00217088 ____N (brother) C:\Windows\SysWOW64\NSSearch.dll
2013-10-15 18:58 - 2010-02-05 10:42 - 00180224 ____N (Brother Industries, Ltd.) C:\Windows\SysWOW64\BroSNMP.dll
2013-10-15 18:58 - 2007-12-13 21:16 - 00073728 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2.dll
2013-10-15 18:58 - 2007-12-13 21:16 - 00005632 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2L.dll
2013-10-15 18:56 - 2013-10-15 18:56 - 00000000 ____D C:\ProgramData\Brother
2013-10-15 18:51 - 2013-10-15 18:53 - 00013058 _____ C:\Windows\DPINST.LOG
2013-10-15 18:51 - 2012-08-20 05:19 - 01560576 _____ (Brother Industries, Ltd.) C:\Windows\system32\BrWi209c.dll
2013-10-15 18:51 - 2010-01-22 08:52 - 00061440 _____ (Brother Industries Ltd.) C:\Windows\SysWOW64\brprtink.dll
2013-10-15 18:51 - 2009-08-18 11:36 - 00050688 _____ (Brother Industries, Ltd.) C:\Windows\system32\BrUsi09c.dll
2013-10-12 15:50 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-12 15:49 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-12 15:49 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-12 15:49 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-12 15:49 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-12 15:49 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-12 15:49 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-12 10:05 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-12 10:05 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-12 10:05 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 10:05 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 10:05 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-12 10:05 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-12 10:05 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-12 10:05 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-12 10:05 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-12 10:05 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-12 10:05 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-12 10:05 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-12 10:05 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-12 10:05 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-12 10:05 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-12 10:05 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-12 10:05 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-12 10:05 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-12 10:05 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-12 10:05 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-12 10:05 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-12 10:05 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-12 10:05 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-12 10:05 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-10-12 10:05 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-10-12 10:05 - 2012-11-28 23:56 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
==================== One Month Modified Files and Folders =======
2013-11-09 18:16 - 2013-11-09 18:16 - 00002638 _____ C:\Users\Admin\Desktop\JRT.txt
2013-11-09 18:13 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-09 18:13 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-09 18:11 - 2011-04-12 08:43 - 00653928 _____ C:\Windows\system32\perfh007.dat
2013-11-09 18:11 - 2011-04-12 08:43 - 00129800 _____ C:\Windows\system32\perfc007.dat
2013-11-09 18:11 - 2009-07-14 06:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-09 18:09 - 2013-11-09 18:09 - 00000000 ____D C:\Windows\ERUNT
2013-11-09 18:06 - 2013-11-09 18:06 - 00008762 _____ C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2013-11-09 18:05 - 2013-08-20 16:57 - 00012417 _____ C:\Windows\setupact.log
2013-11-09 18:05 - 2013-07-25 01:29 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-09 18:05 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-09 18:04 - 2013-07-25 01:19 - 02008252 _____ C:\Windows\WindowsUpdate.log
2013-11-09 18:03 - 2013-11-09 18:02 - 00000000 ____D C:\AdwCleaner
2013-11-09 17:55 - 2013-09-03 18:52 - 00017480 _____ C:\Windows\PFRO.log
2013-11-09 17:47 - 2013-11-09 17:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-09 17:44 - 2013-07-25 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-09 17:41 - 2013-11-09 17:41 - 01034531 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2013-11-09 17:40 - 2013-11-09 17:40 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-09 17:40 - 2013-11-09 17:40 - 01073262 _____ C:\Users\Admin\Desktop\adwcleaner.exe
2013-11-09 17:29 - 2013-07-25 01:38 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-11-09 14:22 - 2013-11-09 14:22 - 00065074 _____ C:\Users\Admin\Desktop\Gmer.txt
2013-11-09 14:22 - 2013-11-09 14:22 - 00000000 ____D C:\Users\Admin\Desktop\Neuer Ordner
2013-11-09 14:10 - 2013-07-25 14:28 - 00200500 _____ C:\Users\Admin\Desktop\Textdokument.txt
2013-11-09 14:07 - 2013-11-09 13:59 - 00022259 _____ C:\Users\Admin\Desktop\FRST.txt
2013-11-09 13:59 - 2013-11-09 13:59 - 00012447 _____ C:\Users\Admin\Desktop\Addition.txt
2013-11-09 13:58 - 2013-11-09 13:58 - 00000000 ____D C:\FRST
2013-11-09 13:57 - 2013-11-09 13:56 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-11-09 13:56 - 2013-11-09 13:56 - 00000000 _____ C:\Users\Admin\defogger_reenable
2013-11-09 13:56 - 2013-07-25 01:25 - 00000000 ____D C:\Users\Admin
2013-11-09 10:11 - 2013-07-25 01:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-09 09:51 - 2013-11-09 09:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-06 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-02 13:26 - 2013-11-02 13:26 - 260730429 _____ C:\Windows\MEMORY.DMP
2013-11-02 13:26 - 2013-11-02 13:26 - 00285104 _____ C:\Windows\Minidump\110213-26176-01.dmp
2013-11-02 13:26 - 2013-11-02 13:26 - 00000000 ____D C:\Windows\Minidump
2013-10-27 22:11 - 2013-07-25 01:49 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2013-10-27 19:44 - 2013-07-25 01:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-27 19:44 - 2013-07-25 01:48 - 00000000 ____D C:\ProgramData\Skype
2013-10-26 18:14 - 2013-07-25 16:32 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-23 21:43 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Documents\*****
2013-10-20 20:59 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-20 20:59 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-20 13:33 - 2013-10-20 13:33 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Brother
2013-10-15 19:00 - 2013-10-15 19:00 - 00000425 _____ C:\Windows\BRWMARK.INI
2013-10-15 18:58 - 2013-10-15 18:58 - 00000050 _____ C:\Windows\system32\BRIDF10A.DAT
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Browny02
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Brother
2013-10-15 18:58 - 2013-07-25 01:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-15 18:56 - 2013-10-15 18:56 - 00000000 ____D C:\ProgramData\Brother
2013-10-15 18:53 - 2013-10-15 18:51 - 00013058 _____ C:\Windows\DPINST.LOG
2013-10-12 20:17 - 2009-07-14 05:45 - 00274464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-12 15:46 - 2013-08-14 12:28 - 00000000 ____D C:\Windows\system32\MRT
2013-10-12 15:44 - 2013-07-25 12:34 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\air1F55.exe
C:\Users\Admin\AppData\Local\Temp\air54E7.exe
C:\Users\Admin\AppData\Local\Temp\air63F1.exe
C:\Users\Admin\AppData\Local\Temp\air9B07.exe
C:\Users\Admin\AppData\Local\Temp\airC5F.exe
C:\Users\Admin\AppData\Local\Temp\dotNetFx40_Client_setup.exe
C:\Users\Admin\AppData\Local\Temp\F6FA_minecraftsetup.exe
C:\Users\Admin\AppData\Local\Temp\FoxyDeal_Setup.exe
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\setup.exe
C:\Users\Admin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Admin\AppData\Local\Temp\uninst1.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-31 21:24
==================== End Of Log ============================
|
|
10.11.2013, 07:24
| #4 |
| /// the machine /// TB-Ausbilder | Win7 Weblayers.exeESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.11.2013, 10:54
| #5 |
| | Win7 Weblayers.exe Mein Antivir Programm ist während des ESET Scans automatisch wieder angegangen, hoffe das hat die Ergebnisse nicht verfälscht. Eset Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f28726e9076b27468beff8ee0557bc14
# engine=15823
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-10 08:47:31
# local_time=2013-11-10 09:47:31 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 91 8525355 160783123 0 0
# compatibility_mode=5893 16776573 100 94 89629 135703101 0 0
# scanned=23370
# found=4
# cleaned=0
# scan_time=499
sh=027CD6A075C55AF4C264A97BC54F004915696451 ft=1 fh=5bbda83c55d4d853 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GW80Q8CW\PCHealthKitINT[1].exe"
sh=55BD02FF1EC2D9A691ADFBAE770A8A3AE7806FEB ft=1 fh=aed99a63b01a44f3 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K6JP12EN\PCHealthKitUS1213b[1].exe"
sh=55BD02FF1EC2D9A691ADFBAE770A8A3AE7806FEB ft=1 fh=aed99a63b01a44f3 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Temp\air1F55.exe"
sh=027CD6A075C55AF4C264A97BC54F004915696451 ft=1 fh=5bbda83c55d4d853 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Temp\air54E7.exe"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f28726e9076b27468beff8ee0557bc14
# engine=15823
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-10 09:42:25
# local_time=2013-11-10 10:42:25 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 91 8528649 160786417 0 0
# compatibility_mode=5893 16776573 100 94 92923 135706395 0 0
# scanned=116850
# found=4
# cleaned=0
# scan_time=3216
sh=027CD6A075C55AF4C264A97BC54F004915696451 ft=1 fh=5bbda83c55d4d853 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GW80Q8CW\PCHealthKitINT[1].exe"
sh=55BD02FF1EC2D9A691ADFBAE770A8A3AE7806FEB ft=1 fh=aed99a63b01a44f3 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K6JP12EN\PCHealthKitUS1213b[1].exe"
sh=55BD02FF1EC2D9A691ADFBAE770A8A3AE7806FEB ft=1 fh=aed99a63b01a44f3 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Temp\air1F55.exe"
sh=027CD6A075C55AF4C264A97BC54F004915696451 ft=1 fh=5bbda83c55d4d853 vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\Users\Admin\AppData\Local\Temp\air54E7.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.9.900.117 Adobe Reader XI Mozilla Firefox (25.0) ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Admin (administrator) on ADMIN-PC on 10-11-2013 10:49:01
Running from C:\Users\Admin\Desktop\Neuer Ordner
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKCU\...\Run: [SoundMax] - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3866624 2009-05-18] (Analog Devices, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2009-06-05] (Analog Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD13A8B30CE88CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmghndmj.default-1378037002191\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2009-06-05] (Andrea Electronics Corporation)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2013-07-25] (ASUSTeK Computer Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2013-07-25] ()
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-25] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-25] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-25] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2013-07-25] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-10 10:43 - 2013-11-10 10:42 - 00003117 _____ C:\Users\Admin\Desktop\Eset.txt
2013-11-10 09:37 - 2013-11-10 09:37 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-10 09:34 - 2013-11-10 09:34 - 00891167 _____ C:\Users\Admin\Desktop\SecurityCheck.exe
2013-11-10 09:33 - 2013-11-10 09:33 - 02347384 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
2013-11-09 18:16 - 2013-11-09 18:16 - 00002638 _____ C:\Users\Admin\Desktop\JRT.txt
2013-11-09 18:09 - 2013-11-09 18:09 - 00000000 ____D C:\Windows\ERUNT
2013-11-09 18:06 - 2013-11-09 18:06 - 00008762 _____ C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2013-11-09 18:02 - 2013-11-09 18:03 - 00000000 ____D C:\AdwCleaner
2013-11-09 17:47 - 2013-11-09 17:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-09 17:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-09 14:22 - 2013-11-10 10:48 - 00000000 ____D C:\Users\Admin\Desktop\Neuer Ordner
2013-11-09 14:22 - 2013-11-09 14:22 - 00065074 _____ C:\Users\Admin\Desktop\Gmer.txt
2013-11-09 13:59 - 2013-11-09 14:07 - 00022259 _____ C:\Users\Admin\Desktop\FRST.txt
2013-11-09 13:59 - 2013-11-09 13:59 - 00012447 _____ C:\Users\Admin\Desktop\Addition.txt
2013-11-09 13:58 - 2013-11-09 13:58 - 00000000 ____D C:\FRST
2013-11-09 13:56 - 2013-11-09 13:57 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-11-09 13:56 - 2013-11-09 13:56 - 00000000 _____ C:\Users\Admin\defogger_reenable
2013-11-09 09:51 - 2013-11-09 09:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-02 13:26 - 2013-11-02 13:26 - 260730429 _____ C:\Windows\MEMORY.DMP
2013-11-02 13:26 - 2013-11-02 13:26 - 00285104 _____ C:\Windows\Minidump\110213-26176-01.dmp
2013-11-02 13:26 - 2013-11-02 13:26 - 00000000 ____D C:\Windows\Minidump
2013-10-20 13:33 - 2013-10-20 13:33 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Brother
2013-10-15 19:00 - 2013-10-15 19:00 - 00000425 _____ C:\Windows\BRWMARK.INI
2013-10-15 18:58 - 2013-10-15 18:58 - 00000050 _____ C:\Windows\system32\BRIDF10A.DAT
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Browny02
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Brother
2013-10-15 18:58 - 2010-03-08 12:50 - 00003072 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2S.dll
2013-10-15 18:58 - 2010-02-09 16:11 - 00217088 ____N (brother) C:\Windows\SysWOW64\NSSearch.dll
2013-10-15 18:58 - 2010-02-05 10:42 - 00180224 ____N (Brother Industries, Ltd.) C:\Windows\SysWOW64\BroSNMP.dll
2013-10-15 18:58 - 2007-12-13 21:16 - 00073728 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2.dll
2013-10-15 18:58 - 2007-12-13 21:16 - 00005632 ____N (Brother Industries Ltd.) C:\Windows\SysWOW64\BrDctF2L.dll
2013-10-15 18:56 - 2013-10-15 18:56 - 00000000 ____D C:\ProgramData\Brother
2013-10-15 18:51 - 2013-10-15 18:53 - 00013058 _____ C:\Windows\DPINST.LOG
2013-10-15 18:51 - 2012-08-20 05:19 - 01560576 _____ (Brother Industries, Ltd.) C:\Windows\system32\BrWi209c.dll
2013-10-15 18:51 - 2010-01-22 08:52 - 00061440 _____ (Brother Industries Ltd.) C:\Windows\SysWOW64\brprtink.dll
2013-10-15 18:51 - 2009-08-18 11:36 - 00050688 _____ (Brother Industries, Ltd.) C:\Windows\system32\BrUsi09c.dll
2013-10-12 15:50 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-12 15:49 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-12 15:49 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-12 15:49 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-12 15:49 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-12 15:49 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-12 15:49 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-12 15:49 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-12 15:49 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-12 15:49 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-12 10:05 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-12 10:05 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-12 10:05 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 10:05 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 10:05 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-12 10:05 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-12 10:05 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-12 10:05 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-12 10:05 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-12 10:05 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-12 10:05 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-12 10:05 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-12 10:05 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-12 10:05 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-12 10:05 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-12 10:05 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-12 10:05 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-12 10:05 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-12 10:05 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-12 10:05 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-12 10:05 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-12 10:05 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-12 10:05 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-12 10:05 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-10-12 10:05 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-10-12 10:05 - 2012-11-28 23:56 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
==================== One Month Modified Files and Folders =======
2013-11-10 10:48 - 2013-11-09 14:22 - 00000000 ____D C:\Users\Admin\Desktop\Neuer Ordner
2013-11-10 10:44 - 2013-07-25 14:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-10 10:42 - 2013-11-10 10:43 - 00003117 _____ C:\Users\Admin\Desktop\Eset.txt
2013-11-10 09:52 - 2013-07-25 01:19 - 02027755 _____ C:\Windows\WindowsUpdate.log
2013-11-10 09:50 - 2011-04-12 08:43 - 00653928 _____ C:\Windows\system32\perfh007.dat
2013-11-10 09:50 - 2011-04-12 08:43 - 00129800 _____ C:\Windows\system32\perfc007.dat
2013-11-10 09:50 - 2009-07-14 06:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-10 09:37 - 2013-11-10 09:37 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-10 09:37 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-10 09:37 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-10 09:34 - 2013-11-10 09:34 - 00891167 _____ C:\Users\Admin\Desktop\SecurityCheck.exe
2013-11-10 09:33 - 2013-11-10 09:33 - 02347384 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
2013-11-10 09:29 - 2013-08-20 16:57 - 00012473 _____ C:\Windows\setupact.log
2013-11-10 09:29 - 2013-07-25 01:29 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-10 09:29 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-09 18:16 - 2013-11-09 18:16 - 00002638 _____ C:\Users\Admin\Desktop\JRT.txt
2013-11-09 18:09 - 2013-11-09 18:09 - 00000000 ____D C:\Windows\ERUNT
2013-11-09 18:06 - 2013-11-09 18:06 - 00008762 _____ C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2013-11-09 18:03 - 2013-11-09 18:02 - 00000000 ____D C:\AdwCleaner
2013-11-09 17:55 - 2013-09-03 18:52 - 00017480 _____ C:\Windows\PFRO.log
2013-11-09 17:47 - 2013-11-09 17:47 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-09 17:46 - 2013-11-09 17:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-09 17:29 - 2013-07-25 01:38 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-11-09 14:22 - 2013-11-09 14:22 - 00065074 _____ C:\Users\Admin\Desktop\Gmer.txt
2013-11-09 14:10 - 2013-07-25 14:28 - 00200500 _____ C:\Users\Admin\Desktop\Textdokument.txt
2013-11-09 14:07 - 2013-11-09 13:59 - 00022259 _____ C:\Users\Admin\Desktop\FRST.txt
2013-11-09 13:59 - 2013-11-09 13:59 - 00012447 _____ C:\Users\Admin\Desktop\Addition.txt
2013-11-09 13:58 - 2013-11-09 13:58 - 00000000 ____D C:\FRST
2013-11-09 13:57 - 2013-11-09 13:56 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2013-11-09 13:56 - 2013-11-09 13:56 - 00000000 _____ C:\Users\Admin\defogger_reenable
2013-11-09 13:56 - 2013-07-25 01:25 - 00000000 ____D C:\Users\Admin
2013-11-09 10:11 - 2013-07-25 01:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-09 09:51 - 2013-11-09 09:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-06 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-02 13:26 - 2013-11-02 13:26 - 260730429 _____ C:\Windows\MEMORY.DMP
2013-11-02 13:26 - 2013-11-02 13:26 - 00285104 _____ C:\Windows\Minidump\110213-26176-01.dmp
2013-11-02 13:26 - 2013-11-02 13:26 - 00000000 ____D C:\Windows\Minidump
2013-10-27 22:11 - 2013-07-25 01:49 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2013-10-27 19:44 - 2013-07-25 01:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-27 19:44 - 2013-07-25 01:48 - 00000000 ____D C:\ProgramData\Skype
2013-10-26 18:14 - 2013-07-25 16:32 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-23 21:43 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Documents\*****
2013-10-20 20:59 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-20 20:59 - 2013-07-25 18:23 - 00000000 ____D C:\Users\Admin\Desktop\*****
2013-10-20 13:33 - 2013-10-20 13:33 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Brother
2013-10-15 19:00 - 2013-10-15 19:00 - 00000425 _____ C:\Windows\BRWMARK.INI
2013-10-15 18:58 - 2013-10-15 18:58 - 00000050 _____ C:\Windows\system32\BRIDF10A.DAT
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Browny02
2013-10-15 18:58 - 2013-10-15 18:58 - 00000000 ____D C:\Program Files (x86)\Brother
2013-10-15 18:58 - 2013-07-25 01:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-15 18:56 - 2013-10-15 18:56 - 00000000 ____D C:\ProgramData\Brother
2013-10-15 18:53 - 2013-10-15 18:51 - 00013058 _____ C:\Windows\DPINST.LOG
2013-10-12 20:17 - 2009-07-14 05:45 - 00274464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-12 15:46 - 2013-08-14 12:28 - 00000000 ____D C:\Windows\system32\MRT
2013-10-12 15:44 - 2013-07-25 12:34 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\air1F55.exe
C:\Users\Admin\AppData\Local\Temp\air54E7.exe
C:\Users\Admin\AppData\Local\Temp\air63F1.exe
C:\Users\Admin\AppData\Local\Temp\air9B07.exe
C:\Users\Admin\AppData\Local\Temp\airC5F.exe
C:\Users\Admin\AppData\Local\Temp\dotNetFx40_Client_setup.exe
C:\Users\Admin\AppData\Local\Temp\F6FA_minecraftsetup.exe
C:\Users\Admin\AppData\Local\Temp\FoxyDeal_Setup.exe
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Admin\AppData\Local\Temp\setup.exe
C:\Users\Admin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Admin\AppData\Local\Temp\uninst1.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-31 21:24
==================== End Of Log ============================
|
|
10.11.2013, 16:04
| #6 |
| /// the machine /// TB-Ausbilder | Win7 Weblayers.exe Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ --> Win7 Weblayers.exe |
|
15.11.2013, 22:10
| #7 |
| | Win7 Weblayers.exe Erstmal viele Dank für Deine Unterstützung. Ich hoffe Du kannst mir noch ein paar Fragen beantworten. 1.Um was für ein Virus hat es sich gehandelt? Muss ich meine Passwörter online ändern? 2.Empfiehlst Du zu bestimmten Zeiten z.B. immer nach 3 Monaten seinen Pc zu formatieren? Ist eine Formatierung in meinem Fall nötig? 3.Man sagt ja, nach dem formatieren ist der Virus "weg". Aber die Daten werden ja nicht "komplett" gelöscht sondern im Speicher verschoben. Können alte Viren wieder auf das System zugreifen? 4.delfix.exe hat nicht alle Programme von meinem Pc gelöscht (waren in einem anderen Ordner). Ist es in Ordnung, wenn ich sie für die Zukunft einfach behalte oder beeinträchtigen sie mein System? 5.Im Forum heißt es ja, man soll sich von Tuning-,Registry-Programmen etc. fernhalten. Aber mein Pc wird von Tag zu Tag langsamer, obwohl ich eigentlich eine sehr gute Hardware habe und Software eigentlich auf dem aktuellsten Stand ist. Was soll ich in diesem Fall machen? Gruß Trw |
|
16.11.2013, 15:39
| #8 | |||||
| /// the machine /// TB-Ausbilder | Win7 Weblayers.exeZitat:
Zitat:
 Zitat:
Zitat:
Zitat:
Reg und Tuning Programme bringen gar nix.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
