| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner AdwareWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
18.11.2013, 18:24
| #1 |
| |  Trojaner Adware Hallo und einen wunderschönen Sonntagabend, als ich gestern meinen Rechner startete meldete sich auf einmal das AnitVir Programm und medete mir den Fund der oben genannte Malware, Avira hat die Malware in Qarantäne verschoben. Leider meldet sich Avira weiterhin bei jedem Start des Computers. Anbei die Kopie des Avira berichts. Könnt ihr mir bitte helfen? Ich habe von Computern und Technik nicht die leiseste Ahnung und wäre wirklich superglücklich über jede Hilfe. Vielen vielen Dank schon einmal im Vorraus. LG Das Apfesinchen |
|
18.11.2013, 19:39
| #2 |
| /// the machine /// TB-Ausbilder    | Trojaner Adware Hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
19.11.2013, 19:30
| #3 |
| | Trojaner Adware Hallo,
__________________hier die beiden Auszüge FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by szanna (administrator) on SZANNA-PC on 19-11-2013 19:25:03
Running from C:\Users\szanna\Downloads
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\ProgramData\BitGuard\2.7.1769.27\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe
(Microsoft Corporation) C:\Windows\system32\schtasks.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\Windows\system32\lxdxcoms.exe
() C:\ProgramData\BitGuard\2.7.1769.27\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
(Lexmark International Inc.) C:\Program Files\Lexmark 3600-4600 Series\ezprint.exe
(Binary Fortress Software) C:\Program Files\TrayStatus\TrayStatus.exe
(Wajam) C:\Program Files\Wajam\Updater\WajamUpdaterV2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Program Files\Overwolf\OverwolfLauncher.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1565992 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-28] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-09-30] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-23] (APN)
HKLM\...\Run: [lxdxmon.exe] - C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe [672424 2010-02-04] ()
HKLM\...\Run: [EzPrint] - C:\Program Files\Lexmark 3600-4600 Series\ezprint.exe [107176 2010-02-04] (Lexmark International Inc.)
HKCU\...\Run: [TrayStatus] - C:\Program Files\TrayStatus\TrayStatus.exe [283032 2011-05-18] (Binary Fortress Software)
HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35256 2013-08-22] (Overwolf)
AppInit_DLLs: C:\ProgramData\BitGuard\2.7.1769.27\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll [ 2013-10-22] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=3AB2206A8A2356C5&affID=125035&tsp=5031
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3A517CE4E1C5CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=3AB2206A8A2356C5&affID=125035&tsp=5031
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799&type=default&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799&type=default&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=3AB2206A8A2356C5&affID=125035&tsp=5031
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=3AB2206A8A2356C5&affID=125035&tsp=5031
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799&type=default&q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: searchgol Helper Object - {8F547BDD-FCD4-48F8-A06F-573D6F404A3C} - C:\Program Files\searchgol\searchgol\1.8.16.19\bh\searchgol.dll (Montera Technologeis LTD)
BHO: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files\Wajam\IE\priam_bho.dll (Wajam)
BHO: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
Toolbar: HKLM - searchgol Toolbar - {00078E95-3A4A-4137-8DE7-2824908D1C17} - C:\Program Files\searchgol\searchgol\1.8.16.19\searchgolTlbr.dll (Montera Technologeis LTD)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\szanna\AppData\Roaming\Mozilla\Firefox\Profiles\wkl5edcp.default
FF NewTab: user_pref("browser.newtab.url", "");
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\szanna\AppData\Roaming\Mozilla\Firefox\Profiles\wkl5edcp.default\Extensions\toolbar_AVIRA-V7@apn.ask.com
FF Extension: toolbar_AVIRA-V7 - C:\Users\szanna\AppData\Roaming\Mozilla\Firefox\Profiles\wkl5edcp.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R2 BitGuard; C:\ProgramData\BitGuard\2.7.1769.27\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [2864096 2013-10-22] ()
S2 bonanzadealslive; C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-10] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-10] (BonanzaDeals)
R2 lxdx_device; C:\Windows\system32\lxdxcoms.exe [589824 2010-02-03] ( )
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 WajamUpdaterV2; C:\Program Files\Wajam\Updater\WajamUpdaterV2.exe [113152 2013-10-10] (Wajam)
==================== Drivers (Whitelisted) ====================
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [101904 2010-08-16] (ATI Technologies, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-30] (Avira GmbH)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-19 19:25 - 2013-11-19 19:25 - 00010562 _____ C:\Users\szanna\Downloads\FRST.txt
2013-11-19 19:24 - 2013-11-19 19:24 - 01090881 _____ (Farbar) C:\Users\szanna\Downloads\FRST.exe
2013-11-19 19:24 - 2013-11-19 19:24 - 00000000 ____D C:\FRST
2013-11-18 18:17 - 2013-11-18 18:17 - 00037698 _____ C:\Users\szanna\Documents\Ereignisse.txt
2013-11-18 17:45 - 2013-11-18 17:45 - 00000000 ____D C:\Program Files\ESET
2013-11-18 17:41 - 2013-11-18 17:42 - 02347384 _____ (ESET) C:\Users\szanna\Downloads\esetsmartinstaller_deu.exe
2013-11-18 16:59 - 2013-11-18 16:59 - 00159144 _____ (Microsoft Corporation) C:\Users\szanna\Downloads\WindowsActivationUpdate.exe
2013-11-17 12:21 - 2013-11-17 12:21 - 00000000 _____ C:\end
2013-11-06 11:02 - 2013-11-06 11:02 - 00000000 ____D C:\Users\szanna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-11-06 11:01 - 2013-11-06 11:01 - 00000000 ____D C:\ProgramData\Overwolf
2013-10-21 17:48 - 2013-10-21 17:48 - 00000252 _____ C:\ProgramData\FastPics.log
2013-10-21 17:48 - 2013-10-21 17:48 - 00000000 ____D C:\ProgramData\Ezprint
2013-10-20 13:36 - 2013-10-20 13:36 - 00001223 _____ C:\Users\szanna\AppData\Local\recently-used.xbel
2013-10-20 13:35 - 2013-10-20 13:35 - 45823368 _____ C:\Users\szanna\Downloads\wu3600-4600Win7ge32.exe
2013-10-20 13:35 - 2013-10-20 13:35 - 00000000 ____D C:\Program Files\Lexmark Toolbar
2013-10-20 13:35 - 2013-10-20 13:35 - 00000000 ____D C:\Program Files\Lexmark 3600-4600 Series
2013-10-20 13:35 - 2008-02-20 15:55 - 00438272 _____ ( ) C:\Windows\system32\LXDXhcp.dll
2013-10-20 13:35 - 2008-02-20 15:49 - 00348160 _____ C:\Windows\system32\LXDXinst.dll
2013-10-20 13:35 - 2008-02-19 02:31 - 00102400 _____ (Lexmark International, Inc.) C:\Windows\system32\lxdxwupd.dll
2013-10-20 13:35 - 2008-02-19 02:31 - 00012288 _____ (Lexmark International, Inc.) C:\Windows\system32\lxdxwupd.exe
2013-10-20 13:33 - 2013-10-20 13:33 - 00000382 _____ C:\Users\Public\Desktop\Complete Installation of Lexmark 3600-4600 Series.LNK
2013-10-20 13:02 - 2013-10-20 13:14 - 00709252 _____ C:\Users\szanna\Desktop\Skizze.svg
2013-10-20 12:42 - 2013-10-20 12:42 - 00027524 _____ C:\Users\szanna\Downloads\taetowierungen.html
2013-10-20 12:35 - 2013-10-20 12:35 - 00000000 ____D C:\Users\szanna\AppData\Roaming\inkscape
2013-10-20 12:32 - 2013-10-20 12:32 - 00000969 _____ C:\Users\Public\Desktop\Inkscape.lnk
2013-10-20 12:29 - 2013-10-20 12:32 - 00000000 ____D C:\Program Files\Inkscape
2013-10-20 12:26 - 2013-10-20 12:26 - 00614816 _____ C:\Users\szanna\Downloads\inkscape-0.48.4-1-win32 - CHIP-Downloader.exe
==================== One Month Modified Files and Folders =======
2013-11-19 19:25 - 2013-11-19 19:25 - 00010562 _____ C:\Users\szanna\Downloads\FRST.txt
2013-11-19 19:24 - 2013-11-19 19:24 - 01090881 _____ (Farbar) C:\Users\szanna\Downloads\FRST.exe
2013-11-19 19:24 - 2013-11-19 19:24 - 00000000 ____D C:\FRST
2013-11-19 19:24 - 2013-10-10 18:37 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-19 19:24 - 2013-10-10 18:26 - 01437833 _____ C:\Windows\WindowsUpdate.log
2013-11-19 19:22 - 2009-07-14 05:34 - 00015104 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-19 19:22 - 2009-07-14 05:34 - 00015104 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-19 19:21 - 2009-07-14 05:39 - 00020976 _____ C:\Windows\setupact.log
2013-11-19 19:19 - 2013-10-15 17:25 - 00000000 ____D C:\Users\szanna\AppData\Local\Overwolf
2013-11-19 19:19 - 2013-10-11 15:48 - 00105786 _____ C:\Windows\PFRO.log
2013-11-19 19:19 - 2013-10-10 21:27 - 00000910 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-11-19 19:19 - 2013-10-10 21:27 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-19 19:19 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 18:32 - 2013-10-10 21:27 - 00000914 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-11-18 18:27 - 2013-10-10 21:27 - 00000296 _____ C:\Windows\Tasks\UpdaterEX.job
2013-11-18 18:17 - 2013-11-18 18:17 - 00037698 _____ C:\Users\szanna\Documents\Ereignisse.txt
2013-11-18 17:45 - 2013-11-18 17:45 - 00000000 ____D C:\Program Files\ESET
2013-11-18 17:42 - 2013-11-18 17:41 - 02347384 _____ (ESET) C:\Users\szanna\Downloads\esetsmartinstaller_deu.exe
2013-11-18 17:39 - 2013-10-10 21:27 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-18 16:59 - 2013-11-18 16:59 - 00159144 _____ (Microsoft Corporation) C:\Users\szanna\Downloads\WindowsActivationUpdate.exe
2013-11-17 12:28 - 2013-10-10 21:26 - 00000000 ____D C:\ProgramData\eSafe
2013-11-17 12:21 - 2013-11-17 12:21 - 00000000 _____ C:\end
2013-11-06 16:46 - 2013-10-10 21:26 - 00000000 ____D C:\ProgramData\BitGuard
2013-11-06 11:11 - 2013-10-10 21:27 - 00000000 ____D C:\Users\szanna\AppData\Local\Mozilla
2013-11-06 11:02 - 2013-11-06 11:02 - 00000000 ____D C:\Users\szanna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-11-06 11:01 - 2013-11-06 11:01 - 00000000 ____D C:\ProgramData\Overwolf
2013-10-21 20:44 - 2013-10-15 17:25 - 00000000 ____D C:\Users\szanna\AppData\Roaming\TS3Client
2013-10-21 17:48 - 2013-10-21 17:48 - 00000252 _____ C:\ProgramData\FastPics.log
2013-10-21 17:48 - 2013-10-21 17:48 - 00000000 ____D C:\ProgramData\Ezprint
2013-10-20 13:37 - 2013-10-18 19:16 - 00000000 ____D C:\ProgramData\lx_Cats
2013-10-20 13:36 - 2013-10-20 13:36 - 00001223 _____ C:\Users\szanna\AppData\Local\recently-used.xbel
2013-10-20 13:36 - 2013-10-18 19:16 - 00018316 _____ C:\Windows\system32\LexFiles.ulf
2013-10-20 13:35 - 2013-10-20 13:35 - 45823368 _____ C:\Users\szanna\Downloads\wu3600-4600Win7ge32.exe
2013-10-20 13:35 - 2013-10-20 13:35 - 00000000 ____D C:\Program Files\Lexmark Toolbar
2013-10-20 13:35 - 2013-10-20 13:35 - 00000000 ____D C:\Program Files\Lexmark 3600-4600 Series
2013-10-20 13:33 - 2013-10-20 13:33 - 00000382 _____ C:\Users\Public\Desktop\Complete Installation of Lexmark 3600-4600 Series.LNK
2013-10-20 13:14 - 2013-10-20 13:02 - 00709252 _____ C:\Users\szanna\Desktop\Skizze.svg
2013-10-20 12:42 - 2013-10-20 12:42 - 00027524 _____ C:\Users\szanna\Downloads\taetowierungen.html
2013-10-20 12:35 - 2013-10-20 12:35 - 00000000 ____D C:\Users\szanna\AppData\Roaming\inkscape
2013-10-20 12:32 - 2013-10-20 12:32 - 00000969 _____ C:\Users\Public\Desktop\Inkscape.lnk
2013-10-20 12:32 - 2013-10-20 12:29 - 00000000 ____D C:\Program Files\Inkscape
2013-10-20 12:26 - 2013-10-20 12:26 - 00614816 _____ C:\Users\szanna\Downloads\inkscape-0.48.4-1-win32 - CHIP-Downloader.exe
Some content of TEMP:
====================
C:\Users\szanna\AppData\Local\Temp\avgnt.exe
C:\Users\szanna\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\szanna\AppData\Local\Temp\Gw2.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-18 18:43
==================== End Of Log ============================
--- --- --- und der Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-11-2013
Ran by szanna at 2013-11-19 19:26:10
Running from C:\Users\szanna\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Acer System Information (Version: 1.0.0)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Atheros Client Installation Program (Version: 7.0)
ATI Catalyst Install Manager (Version: 3.0.786.0)
Avira Free Antivirus (Version: 14.0.0.383)
Avira SearchFree Toolbar (Version: 12.6.0.1898)
BitGuard
Bonanza Deals (remove only) (Version: 5.0.1.0)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Vista (Version: 2010.0828.2240.38829)
Catalyst Control Center InstallProxy (Version: 2010.0828.2240.38829)
Catalyst Control Center Localization All (Version: 2010.0828.2240.38829)
CCC Help Chinese Standard (Version: 2010.0828.2239.38829)
CCC Help Chinese Traditional (Version: 2010.0828.2239.38829)
CCC Help Czech (Version: 2010.0828.2239.38829)
CCC Help Danish (Version: 2010.0828.2239.38829)
CCC Help Dutch (Version: 2010.0828.2239.38829)
CCC Help English (Version: 2010.0828.2239.38829)
CCC Help Finnish (Version: 2010.0828.2239.38829)
CCC Help French (Version: 2010.0828.2239.38829)
CCC Help German (Version: 2010.0828.2239.38829)
CCC Help Greek (Version: 2010.0828.2239.38829)
CCC Help Hungarian (Version: 2010.0828.2239.38829)
CCC Help Italian (Version: 2010.0828.2239.38829)
CCC Help Japanese (Version: 2010.0828.2239.38829)
CCC Help Korean (Version: 2010.0828.2239.38829)
CCC Help Norwegian (Version: 2010.0828.2239.38829)
CCC Help Polish (Version: 2010.0828.2239.38829)
CCC Help Portuguese (Version: 2010.0828.2239.38829)
CCC Help Russian (Version: 2010.0828.2239.38829)
CCC Help Spanish (Version: 2010.0828.2239.38829)
CCC Help Swedish (Version: 2010.0828.2239.38829)
CCC Help Thai (Version: 2010.0828.2239.38829)
CCC Help Turkish (Version: 2010.0828.2239.38829)
ccc-core-static (Version: 2010.0828.2240.38829)
ccc-utility (Version: 2010.0828.2240.38829)
ESET Online Scanner v3
Extended Update
Google Update Helper (Version: 1.3.23.0)
GUILD WARS
Guild Wars 2
Inkscape 0.48.4 (Version: 0.48.4)
Intel(R) Management Engine Components (Version: 6.0.0.1179)
Lexmark 3600-4600 Series
LibreOffice 4.1 Help Pack (German) (Version: 4.1.2.3)
LibreOffice 4.1.2.3 (Version: 4.1.2.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 25.0.1 (x86 de) (Version: 25.0.1)
Mozilla Maintenance Service (Version: 25.0.1)
Overwolf (Version: 0.44.256)
PX Profile Update (Version: 1.00.1.)
Search-Gol Chrome Toolbar
searchgol toolbar (Version: 1.8.16.19)
Synaptics Pointing Device Driver (Version: 14.0.6.0)
TeamSpeak 3 Client (Version: 3.0.13)
TrayStatus 1.2.3 (Version: 1.2.3.0)
Wajam (Version: 2.00)
Wsys Control 10.2.1.2652 (Version: 10.2.1.2652)
==================== Restore Points =========================
10-10-2013 17:54:25 Windows Update
10-10-2013 17:58:18 Windows Update
10-10-2013 18:00:05 Windows Update
10-10-2013 18:31:15 Installed Acer System Information
11-10-2013 04:38:33 Windows Update
11-10-2013 15:03:47 Installed LibreOffice 4.1 Help Pack (German)
11-10-2013 15:06:04 Installed LibreOffice 4.1.2.3
11-10-2013 16:06:30 Windows Update
13-10-2013 11:53:46 Windows Update
13-10-2013 20:08:17 Windows Update
15-10-2013 15:41:27 Windows Update
15-10-2013 19:31:35 Windows Update
18-11-2013 15:59:54 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {21129B41-806B-4175-B42E-7B320CC14EBF} - System32\Tasks\EPUpdater => C:\Users\szanna\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-09-01] ()
Task: {256D9252-A8D7-49A6-BB85-6E9555A20116} - System32\Tasks\UpdaterEX => C:\Users\szanna\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE
Task: {6BC42283-3E22-4D19-9FA2-AF302EB1790C} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-10] (BonanzaDeals)
Task: {6CF1C773-CEFC-45F2-959E-FC4D4F761BA5} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-10] (BonanzaDeals)
Task: {F5324D27-D5CF-4CCE-9D36-EB4E7240F220} - System32\Tasks\Installation App Launcher => C:\Program Files\Lexmark 3600-4600 Series\ezprint.exe [2010-02-04] (Lexmark International Inc.)
Task: {FF17DE69-1A7F-4650-BAE0-568B71E1D50B} - System32\Tasks\BonanzaDealsUpdate => C:\Program
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\szanna\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE
==================== Loaded Modules (whitelisted) =============
2013-11-06 11:01 - 2013-10-22 16:09 - 02735584 _____ () C:\ProgramData\BitGuard\2.7.1769.27\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll
2013-10-20 13:35 - 2010-02-04 00:04 - 00380928 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxscw.dll
2013-10-20 13:35 - 2010-02-03 23:52 - 00589824 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxdatr.dll
2013-10-20 13:35 - 2010-02-04 00:04 - 00782336 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxDRS.dll
2013-10-20 13:35 - 2010-02-04 00:05 - 00081920 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcaps.dll
2013-10-20 13:35 - 2010-02-03 23:52 - 00069632 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcnv4.dll
2013-10-20 13:35 - 2010-02-04 00:02 - 00364544 _____ () C:\Program Files\Lexmark 3600-4600 Series\iptk.dll
2013-10-20 13:35 - 2007-09-06 04:11 - 00151552 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxptp.dll
2013-10-10 21:27 - 2013-11-18 17:39 - 03363952 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/19/2013 07:19:58 PM) (Source: PerfNet) (User: )
Description:
Error: (11/17/2013 00:20:38 PM) (Source: PerfNet) (User: )
Description:
Error: (11/17/2013 00:20:38 PM) (Source: PerfNet) (User: )
Description:
Error: (11/07/2013 04:10:36 PM) (Source: PerfNet) (User: )
Description:
Error: (11/07/2013 04:10:36 PM) (Source: PerfNet) (User: )
Description:
Error: (11/06/2013 04:46:44 PM) (Source: PerfNet) (User: )
Description:
Error: (11/06/2013 04:46:44 PM) (Source: PerfNet) (User: )
Description:
Error: (11/06/2013 10:59:29 AM) (Source: PerfNet) (User: )
Description:
Error: (11/06/2013 10:59:29 AM) (Source: PerfNet) (User: )
Description:
Error: (10/24/2013 08:06:25 PM) (Source: PerfNet) (User: )
Description:
System errors:
=============
Error: (11/19/2013 07:20:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Overwolf Updater Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (11/19/2013 07:20:51 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Overwolf Updater Service erreicht.
Error: (11/19/2013 07:19:29 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
Modulpfad: C:\Windows\system32\athExt.dll
Fehlercode: 126
Error: (11/18/2013 05:32:38 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.
Error: (11/18/2013 05:32:33 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.
Error: (11/18/2013 05:32:27 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.
Error: (11/18/2013 05:32:21 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.
Error: (11/18/2013 04:52:31 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
Modulpfad: C:\Windows\system32\athExt.dll
Fehlercode: 126
Error: (11/18/2013 04:52:31 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 17.11.2013 um 13:11:47 unerwartet heruntergefahren.
Error: (11/17/2013 00:32:33 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.
Microsoft Office Sessions:
=========================
Error: (11/19/2013 07:19:58 PM) (Source: PerfNet)(User: )
Description:
Error: (11/17/2013 00:20:38 PM) (Source: PerfNet)(User: )
Description:
Error: (11/17/2013 00:20:38 PM) (Source: PerfNet)(User: )
Description:
Error: (11/07/2013 04:10:36 PM) (Source: PerfNet)(User: )
Description:
Error: (11/07/2013 04:10:36 PM) (Source: PerfNet)(User: )
Description:
Error: (11/06/2013 04:46:44 PM) (Source: PerfNet)(User: )
Description:
Error: (11/06/2013 04:46:44 PM) (Source: PerfNet)(User: )
Description:
Error: (11/06/2013 10:59:29 AM) (Source: PerfNet)(User: )
Description:
Error: (11/06/2013 10:59:29 AM) (Source: PerfNet)(User: )
Description:
Error: (10/24/2013 08:06:25 PM) (Source: PerfNet)(User: )
Description:
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 3060.5 MB
Available physical RAM: 1792.84 MB
Total Pagefile: 6119.28 MB
Available Pagefile: 4488.21 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.13 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.76 GB) (Free:420.33 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: A2C2C36D)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
20.11.2013, 12:31
| #4 |
| /// the machine /// TB-Ausbilder | Trojaner Adware hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.11.2013, 11:18
| #5 |
| | Trojaner Adware Hallo, habe es erst heute wieder an den Rechner geschafft. Code:
ATTFilter ComboFix 13-11-22.01 - szanna 23.11.2013 11:06:32.1.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3060.1985 [GMT 1:00]
ausgeführt von:: c:\users\szanna\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Autorun.inf
C:\END
c:\windows\system32\FlashPlayerApp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-23 bis 2013-11-23 ))))))))))))))))))))))))))))))
.
.
2013-11-19 18:32 . 2013-11-18 00:28 7772552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3C7949F-5A55-45D7-AC22-9070E94F157B}\mpengine.dll
2013-11-19 18:24 . 2013-11-19 18:24 -------- d-----w- C:\FRST
2013-11-18 16:45 . 2013-11-18 16:45 -------- d-----w- c:\program files\ESET
2013-11-18 16:00 . 2013-11-18 16:00 -------- d-----w- c:\windows\system32\Wat
2013-11-06 10:01 . 2013-11-06 10:01 -------- d-----w- c:\programdata\Overwolf
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-13 12:00 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2013-10-11 15:26 . 2013-10-11 15:26 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-11 04:47 . 2013-10-11 04:47 86528 ----a-w- c:\windows\system32\iesysprep.dll
2013-10-11 04:47 . 2013-10-11 04:47 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-10-11 04:47 . 2013-10-11 04:47 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-10-11 04:47 . 2013-10-11 04:47 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-10-11 04:47 . 2013-10-11 04:47 161792 ----a-w- c:\windows\system32\msls31.dll
2013-10-11 04:47 . 2013-10-11 04:47 1129472 ----a-w- c:\windows\system32\wininet.dll
2013-10-11 04:47 . 2013-10-11 04:47 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-10-11 04:47 . 2013-10-11 04:47 74752 ----a-w- c:\windows\system32\iesetup.dll
2013-10-11 04:47 . 2013-10-11 04:47 63488 ----a-w- c:\windows\system32\tdc.ocx
2013-10-11 04:47 . 2013-10-11 04:47 420864 ----a-w- c:\windows\system32\vbscript.dll
2013-10-11 04:47 . 2013-10-11 04:47 367104 ----a-w- c:\windows\system32\html.iec
2013-10-11 04:47 . 2013-10-11 04:47 35840 ----a-w- c:\windows\system32\imgutil.dll
2013-10-11 04:47 . 2013-10-11 04:47 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2013-10-11 04:47 . 2013-10-11 04:47 23552 ----a-w- c:\windows\system32\licmgr10.dll
2013-10-11 04:47 . 2013-10-11 04:47 1800704 ----a-w- c:\windows\system32\jscript9.dll
2013-10-11 04:47 . 2013-10-11 04:47 152064 ----a-w- c:\windows\system32\wextract.exe
2013-10-11 04:47 . 2013-10-11 04:47 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-10-11 04:47 . 2013-10-11 04:47 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2013-10-11 04:47 . 2013-10-11 04:47 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2013-10-11 04:47 . 2013-10-11 04:47 11776 ----a-w- c:\windows\system32\mshta.exe
2013-10-11 04:47 . 2013-10-11 04:47 101888 ----a-w- c:\windows\system32\admparse.dll
2013-10-10 18:21 . 2009-10-16 01:31 274984 ----a-w- c:\windows\system32\drivers\k57nd60x.sys
2013-09-30 09:01 . 2013-10-10 21:00 89376 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-30 09:01 . 2013-10-10 21:00 67680 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-30 09:01 . 2013-10-10 21:00 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-09-30 09:01 . 2013-10-10 21:00 137208 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-30 07:08 . 2013-09-30 07:08 773968 ----a-w- c:\windows\system32\msvcr100.dll
2013-09-30 07:08 . 2013-09-30 07:08 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-09-03 12:35 . 2013-10-10 17:58 238872 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2013-10-23 18:43 12240 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-10-23 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-10-23 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrayStatus"="c:\program files\TrayStatus\TrayStatus.exe" [2011-05-18 283032]
"Overwolf"="c:\program files\Overwolf\Overwolf.exe" [2013-08-22 35256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-09-17 1565992]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-28 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-09-30 681032]
"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-10-23 1673680]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2010-02-03 672424]
"EzPrint"="c:\program files\Lexmark 3600-4600 Series\ezprint.exe" [2010-02-03 107176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-10-13 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\BitGuard\271769~1.27\{C16C1~1\BitGuard.dll
.
R2 bonanzadealslive;BonanzaDealsLive-Dienst (bonanzadealslive);c:\program files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-10 148976]
R3 bonanzadealslivem;BonanzaDealsLive-Dienst (bonanzadealslivem);c:\program files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-10 148976]
R3 OverwolfUpdaterService;Overwolf Updater Service;c:\program files\Overwolf\OverwolfUpdater.exe [2013-08-22 18360]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2013-11-18 1343400]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-09-30 37352]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-28 176128]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-09-30 440392]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2013-09-30 1164360]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [2013-10-23 166352]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2013-09-30 67680]
S2 BitGuard;BitGuard;c:\programdata\BitGuard\2.7.1769.27\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [2013-10-22 2864096]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe [2010-02-03 589824]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S2 WajamUpdaterV2;WajamUpdaterV2;c:\program files\Wajam\Updater\WajamUpdaterV2.exe [2013-10-10 113152]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-08-16 101904]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2013-10-10 274984]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-23 c:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
- c:\program files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-10 20:26]
.
2013-11-19 c:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
- c:\program files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-10 20:26]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=3AB2206A8A2356C5&affID=125035&tsp=5031
mStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMQ01ABD050_43F2FX3ASXX43F2FX3AS&ts=1381436799
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\szanna\AppData\Roaming\Mozilla\Firefox\Profiles\wkl5edcp.default\
FF - ExtSQL: 2013-09-24 03:19; toolbar_AVIRA-V7@apn.ask.com; c:\users\szanna\AppData\Roaming\Mozilla\Firefox\Profiles\wkl5edcp.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-WsysControl - c:\programdata\eSafe\eGdpSvc.exe
AddRemove-UpdaterEX - c:\users\szanna\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-11-23 11:14:15
ComboFix-quarantined-files.txt 2013-11-23 10:14
.
Vor Suchlauf: 12 Verzeichnis(se), 451.021.377.536 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 459.930.062.848 Bytes frei
.
- - End Of File - - CA0D8488575FA57204E73A534F00DBC8
A36C5E4F47E84449FF07ED3517B43A31
SChönes Wochende noch  |
|
24.11.2013, 08:16
| #6 |
| /// the machine /// TB-Ausbilder | Trojaner Adware Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Trojaner Adware |
|
| Themen zu Trojaner Adware |
| adware, ahnung, anbei, anitvir, auf einmal, avira, compu, computern, fund, gestern, malware, melde, programm, rechner, starte, technik, troja, trojaner, wirklich |
WARNUNG an die MITLESER: 
Linear-Darstellung
