| |
| |||||||
Log-Analyse und Auswertung: Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
19.11.2013, 13:02
| #1 |
| |  Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Hallo, wie im Betreff angegeben, kann ich im Firefox nicht abstellen, dass die "certified toolbar" aktiv wird und/oder sich einnistet. Würde es gerne loswerden. Das Windows XP ist schwedisch, aber ich kann beide Sprachen und kenne sowohl die deutsche als auch die schwedische Windows XP Version soweit als dass ich Programme installieren kann und in der Systemsteuerung herummachen kann. Tom |
|
19.11.2013, 13:11
| #2 |
| /// the machine /// TB-Ausbilder    | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
19.11.2013, 14:52
| #3 |
| | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt okay, hier kommts:! Die # taste auf der Webseite habe ich nicht gefunden...
__________________--snip FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by Birgitta (administrator) on BIRGITTA-9FD6B2 on 19-11-2013 14:34:13
Running from C:\Documents and Settings\Birgitta\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 6
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
() C:\windows\system32\Ati2evxx.exe
() C:\windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\windows\System32\bcmwltry.exe
(Microsoft Corporation) C:\windows\System32\SCardSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\windows\system32\Ati2evxx.exe
(Simplygen) C:\Program Files\HomeTab\ProtectedSearch.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dell Inc.) C:\WINDOWS\system32\WLTRAY.exe
(Seagate) C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ZTE) C:\Program Files\Connect Manager\Bin\mcserver.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\ouc.exe
(Microsoft Corporation) C:\windows\system32\cmd.exe
() C:\Program Files\Connect Manager\Bin\dbus-daemon.exe
() C:\Program Files\Connect Manager\Bin\db_daemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\windows\system32\wscntfy.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\LiveUpdate.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ATIModeChange] - C:\WINDOWS\system32\Ati2mdxx.exe [28672 2001-09-04] (ATI Technologies, Inc.)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [335872 2003-07-29] (ATI Technologies, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [384800 2012-12-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\WINDOWS\system32\WLTRAY.EXE [1347584 2005-12-19] (Dell Inc.)
HKLM\...\Run: [DiscWizardMonitor.exe] - C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [2638152 2011-06-30] (Seagate)
HKLM\...\Run: [Seagate Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395152 2011-06-30] (Seagate)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll ()
HKCU\...\Run: [HW_OPENEYE_OUC_Mobile Partner] - C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [110592 2009-07-27] (Huawei Technologies Co., Ltd.)
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {28a17bc0-8230-11e1-8338-000bdba7cd9e} - nmusbcfg.exe
MountPoints2: {2a6e2b54-b443-11e0-832a-000bdba7cd9e} - E:\windows\Data\AutoRun.exe
MountPoints2: {8d8849f0-e4ee-11e2-8394-000bdba7cd9e} - E:\AutoRun.exe
MountPoints2: {8d8849f3-e4ee-11e2-8394-000bdba7cd9e} - E:\AutoRun.exe
MountPoints2: {a559e010-f935-11e2-8396-000bdba7cd9e} - E:\AutoRun.exe
MountPoints2: {e90f46b1-fe6b-11e0-8331-000bdba7cd9e} - E:\AutoRun.exe
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MCtlSvc.lnk
ShortcutTarget: MCtlSvc.lnk -> C:\Program Files\Connect Manager\Bin\mcserver.exe (ZTE)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.7&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.7&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: HomeTab - {ad3daa4e-8c03-4eeb-9926-a500ee85d639} - C:\Documents and Settings\Birgitta\Application Data\HomeTab\HomeTab.dll (Simply Tech LTD.)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - HomeTab - {ad3daa4e-8c03-4eeb-9926-a500ee85d639} - C:\Documents and Settings\Birgitta\Application Data\HomeTab\HomeTab.dll (Simply Tech LTD.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1372873530110
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.10.2 10.0.10.3
FireFox:
========
FF ProfilePath: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default
FF NewTab: about:home
FF DefaultSearchEngine: Web Search
FF SearchEngineOrder.1: Web Search
FF SelectedSearchEngine: Web Search
FF Homepage: about:home
FF Keyword.URL: hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml
FF Extension: No Name - C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [85280 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [109344 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [323584 2003-07-29] ()
R2 DCService.exe; C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe [229376 2010-08-19] ()
R2 SgtSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [845808 2011-06-30] (Seagate)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [1200128 2005-12-19] (Dell Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83944 2012-11-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134336 2012-11-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36552 2012-11-22] (Avira Operations GmbH & Co. KG)
R3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl5.sys [424320 2005-11-02] (Broadcom Corporation)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
R3 HSFHWICH; C:\Windows\System32\DRIVERS\HSFHWICH.sys [189056 2003-07-03] (Conexant Systems, Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-09] (MBB Incorporated)
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscr.sys [91395 2003-12-11] (O2Micro)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 STAC97; C:\Windows\System32\drivers\stac97.sys [258704 2004-05-12] (SigmaTel, Inc.)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [125472 2013-09-11] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [83392 2013-09-11] (Acronis)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [126976 2011-03-09] (ZTE Corporation)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [117504 2010-08-27] (Huawei Technologies Co., Ltd.)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
U1 WS2IFSL;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-19 14:34 - 2013-11-19 14:35 - 00015107 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
2013-11-19 14:32 - 2013-11-19 14:29 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-11-01 09:33 - 2013-11-01 09:33 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\HomeTab
2013-10-21 12:15 - 2013-11-19 12:52 - 00000000 ____D C:\Program Files\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2013-11-19 14:35 - 2013-11-19 14:34 - 00015107 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
2013-11-19 14:29 - 2013-11-19 14:32 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-11-19 14:29 - 2011-07-22 11:17 - 00000000 ____D C:\Documents and Settings\Birgitta\My Documents\Hämtade filer
2013-11-19 14:19 - 2011-07-22 09:50 - 01779434 _____ C:\windows\WindowsUpdate.log
2013-11-19 12:52 - 2013-10-21 12:15 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-19 12:50 - 2003-05-29 02:32 - 00548064 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-19 12:45 - 2013-09-01 20:26 - 00000284 _____ C:\windows\Tasks\Protected Search.job
2013-11-19 12:45 - 2012-04-03 11:08 - 00000982 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-19 12:45 - 2011-07-22 09:59 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-19 12:45 - 2004-08-04 11:00 - 00002206 _____ C:\windows\system32\wpa.dbl
2013-11-10 02:46 - 2011-07-22 10:00 - 00000178 ___SH C:\Documents and Settings\Birgitta\ntuser.ini
2013-11-10 02:46 - 2011-07-22 10:00 - 00000000 ____D C:\Documents and Settings\Birgitta
2013-11-10 02:46 - 2011-07-22 09:59 - 00032638 _____ C:\windows\SchedLgU.Txt
2013-11-09 18:00 - 2012-04-03 11:08 - 00000986 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-02 09:33 - 2013-07-04 21:25 - 00000374 _____ C:\windows\Tasks\Browser Updater.job
2013-11-02 08:38 - 2013-07-04 22:25 - 00000000 ____D C:\Documents and Settings\Birgitta\Local Settings\Application Data\Adobe
2013-11-02 08:38 - 2011-07-22 10:56 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Adobe
2013-11-01 09:33 - 2013-11-01 09:33 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\HomeTab
2013-11-01 09:33 - 2013-07-04 21:25 - 00000000 ____D C:\Program Files\HomeTab
2013-11-01 07:58 - 2013-09-15 00:43 - 00000000 ____D C:\windows\system32\NtmsData
2013-11-01 07:57 - 2011-07-22 09:48 - 00000000 ____D C:\windows\Registration
2013-10-22 08:20 - 2013-01-30 09:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-21 08:57 - 2013-07-04 21:25 - 00000000 ____D C:\Documents and Settings\Birgitta\Local Settings\Application Data\HomeTab
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2004-08-04 11:00] - [2008-04-14 05:42] - 0108544 ____A (Microsoft Corporation) 0e776ed5f7cc9f94299e70461b7b8185
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
und hier addition:FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-11-2013
Ran by Birgitta at 2013-11-19 14:39:46
Running from C:\Documents and Settings\Birgitta\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}
==================== Installed Programs ======================
32 Bit HP CIO Components Installer (Version: 6.1.1)
Adobe Flash Player 10 ActiveX (Version: 10.3.181.34)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Reader XI (11.0.03) (Version: 11.0.03)
ATI - Software Uninstall Utility (Version: 6.14.10.1005)
ATI Control Panel (Version: 6.14.10.5028)
ATI Display Driver (Version: 7.91.2-030729a-010470C-Dell)
Avira Free Antivirus (Version: 13.0.0.2890)
Broadcom Gigabit Integrated Controller (Version: 3.61)
BufferChm (Version: 140.0.212.000)
CCleaner (Version: 4.03)
Conexant D480 MDC V.9x Modem
Connect Manager (Version: 1.00.0000)
Coupon Printer for Windows (Version: 5.0.0.0)
D2600 (Version: 140.0.690.000)
Dell ResourceCD
Dell Wireless WLAN Card (Version: 4.10.47.3)
DeviceDiscovery (Version: 140.0.212.000)
DJ_SF_05_D2600_Software_Min (Version: 140.0.690.000)
Google Update Helper (Version: 1.3.21.165)
GPBaseService2 (Version: 140.0.211.000)
HomeTab 4.9 (Version: 4.9)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Deskjet D2600 Printer Driver Software 14.0 Rel. 5 (Version: 14.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP Photo Creations (Version: 1.0.0.2024)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Update (Version: 5.002.002.002)
HPProductAssistant (Version: 140.0.212.000)
HPSSupply (Version: 140.0.211.000)
MarketResearch (Version: 140.0.212.000)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office Access MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Enterprise 2007 (Version: 12.0.4518.1014)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Software Update for Web Folders (English) 12 (Version: 12.0.4518.1014)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mobile Partner (Version: 16.002.21.02.24)
Mozilla Firefox 24.0 (x86 sv-SE) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
O2Micro Smartcard Driver (Version: 2.20.0000)
Seagate DiscWizard (Version: 13.0.14387)
SeaTools for Windows (Version: 1.2.0.7)
Shop for HP Supplies (Version: 14.0)
SigmaTel AC97 Audio Drivers (Version: 4029)
Skype™ 6.6 (Version: 6.6.106)
SmartWebPrinting (Version: 140.0.186.000)
SolutionCenter (Version: 140.0.213.000)
Status (Version: 140.0.212.000)
Toolbox (Version: 140.0.428.000)
TrayApp (Version: 140.0.212.000)
Update for Windows XP (KB898461) (Version: 1)
WebFldrs XP (Version: 9.50.7523)
WebReg (Version: 140.0.212.017)
Windows XP Service Pack 3 (Version: 20080414.031525)
VLC media player 2.0.8 (Version: 2.0.8)
==================== Restore Points =========================
30-07-2013 18:34:05 System Checkpoint
26-08-2013 06:41:06 System Checkpoint
27-08-2013 09:01:24 System Checkpoint
01-09-2013 15:53:11 System Checkpoint
01-09-2013 20:17:14 Installed SeaTools for Windows
11-09-2013 19:39:51 Installed Seagate DiscWizard
14-09-2013 22:07:20 Installed Adobe Reader XI (11.0.03).
14-09-2013 22:12:53 Installed DirectX 9.0
21-09-2013 20:03:29 System Checkpoint
30-09-2013 16:03:12 System Checkpoint
01-10-2013 16:11:53 System Checkpoint
02-10-2013 16:45:40 System Checkpoint
21-10-2013 08:33:01 System Checkpoint
22-10-2013 08:44:11 System Checkpoint
23-10-2013 09:44:12 System Checkpoint
01-11-2013 08:16:59 System Checkpoint
==================== Hosts content: ==========================
2004-08-04 11:00 - 2004-08-04 11:00 - 00000734 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: C:\windows\Tasks\Browser Updater.job => C:\Program Files\HomeTab\TBUpdater.dll
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Protected Search.job => C:\Program Files\HomeTab\ProtectedSearch.exe
==================== Loaded Modules (whitelisted) =============
2011-07-22 10:12 - 2003-07-29 14:11 - 00086016 _____ () C:\windows\system32\Ati2evxx.dll
2013-09-01 19:24 - 2005-12-19 09:08 - 00757760 _____ () C:\windows\System32\bcm1xsup.dll
2013-07-04 21:40 - 2012-09-19 18:17 - 00397088 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2013-07-04 21:25 - 2013-08-29 07:22 - 00107592 _____ () C:\Program Files\HomeTab\InstallHelper.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00594944 _____ () C:\Program Files\Connect Manager\Bin\dbus-1.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00093696 _____ () C:\Program Files\Connect Manager\Bin\itapi.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00026112 _____ () C:\Program Files\Connect Manager\Bin\log.dll
2011-07-22 10:16 - 2010-10-14 10:37 - 00971776 _____ () C:\Program Files\Connect Manager\Bin\libxml2.dll
2011-07-22 10:16 - 2010-10-14 10:37 - 00080688 _____ () C:\Program Files\Connect Manager\Bin\zlib1.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00054784 _____ () C:\Program Files\Connect Manager\Bin\coder.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00043008 _____ () C:\Program Files\Connect Manager\Bin\audio.dll
2011-07-22 10:16 - 2011-04-18 02:43 - 00034816 _____ () C:\Program Files\Connect Manager\Bin\libConfig.dll
2011-07-22 10:16 - 2011-04-18 02:46 - 00020992 _____ () C:\Program Files\Connect Manager\Bin\libctlsvr.dll
2011-07-22 10:16 - 2007-09-09 16:07 - 00151552 _____ () C:\Program Files\Connect Manager\Bin\libexpat.dll
2011-07-22 10:16 - 2010-12-06 07:12 - 00341504 _____ () C:\Program Files\Connect Manager\Bin\sqlite3.dll
2013-10-21 12:15 - 2013-10-21 12:16 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/02/2013 01:34:51 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (11/02/2013 01:34:48 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (11/02/2013 01:34:31 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (11/02/2013 01:14:45 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (11/02/2013 01:11:28 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (11/02/2013 01:08:26 PM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (11/02/2013 08:41:12 AM) (Source: Application Hang) (User: )
Description: Hanging application AcroRd32.exe, version 11.0.3.37, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (08/26/2013 03:23:05 PM) (Source: Application Hang) (User: )
Description: Hanging application firefox.exe, version 22.0.0.4917, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (08/26/2013 03:17:43 PM) (Source: Application Hang) (User: )
Description: Hanging application firefox.exe, version 22.0.0.4917, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (07/04/2013 07:14:30 PM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
System errors:
=============
Error: (11/09/2013 05:40:11 PM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.
Error: (11/09/2013 05:40:11 PM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)
Error: (10/21/2013 07:42:10 AM) (Source: Windows Update Agent) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.
Error: (10/21/2013 07:41:44 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: The server {4EB61BAC-A3B6-4760-9581-655041EF4D69} did not register with DCOM within the required timeout.
Error: (10/02/2013 04:43:27 PM) (Source: Windows Update Agent) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.
Error: (09/22/2013 10:44:42 AM) (Source: Dhcp) (User: )
Description: The IP address lease 192.168.0.3 for the Network Card with network address 00904BB371DA has been
denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
Error: (09/21/2013 08:06:35 PM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.
Error: (09/21/2013 08:06:35 PM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)
Error: (09/15/2013 01:57:18 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: The server {D61A27C6-8F53-11D0-BFA0-00A024151983} did not register with DCOM within the required timeout.
Error: (09/14/2013 10:48:46 PM) (Source: Dhcp) (User: )
Description: The IP address lease 192.168.0.3 for the Network Card with network address 00904BB371DA has been
denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 29%
Total physical RAM: 2047.23 MB
Available physical RAM: 1453.22 MB
Total Pagefile: 3944.92 MB
Available Pagefile: 3390.4 MB
Total Virtual: 2047.88 MB
Available Virtual: 1972.71 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.79 GB) (Free:101.04 GB) NTFS ==>[Drive with boot components (Windows XP)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 112 GB) (Disk ID: 49460703)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
20.11.2013, 09:52
| #4 |
| /// the machine /// TB-Ausbilder | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.11.2013, 10:36
| #5 |
| | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Hallo, hier kommts... # Combofix Logfile: Code:
ATTFilter ComboFix 13-11-19.01 - Birgitta 2013-11-21 8:41.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1683 [GMT 1:00]
Running from: c:\documents and settings\Birgitta\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\FlashPlayerApp.exe
c:\windows\Tasks\Protected Search.job
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DCSERVICE.EXE
-------\Service_DCService.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-10-21 to 2013-11-21 )))))))))))))))))))))))))))))))
.
.
2013-11-19 13:33 . 2013-11-19 13:33 -------- d-----w- C:\FRST
2013-11-01 08:33 . 2013-11-01 08:33 -------- d-----w- c:\documents and settings\Birgitta\Application Data\HomeTab
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-14 22:48 . 2011-07-22 09:19 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-11 19:41 . 2013-09-11 19:40 601408 ----a-w- c:\windows\system32\drivers\timntr.sys
2013-09-11 19:40 . 2013-09-11 19:40 125472 ----a-w- c:\windows\system32\drivers\vididr.sys
2013-09-11 19:40 . 2013-09-11 19:40 83392 ----a-w- c:\windows\system32\drivers\vsflt53.sys
2013-09-11 19:40 . 2013-09-11 19:40 169088 ----a-w- c:\windows\system32\drivers\snapman.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{ad3daa4e-8c03-4eeb-9926-a500ee85d639}]
2013-10-25 14:58 1092680 ----a-w- c:\documents and settings\Birgitta\Application Data\HomeTab\HomeTab.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ad3daa4e-8c03-4eeb-9926-a500ee85d639}"= "c:\documents and settings\Birgitta\Application Data\HomeTab\HomeTab.dll" [2013-10-25 1092680]
.
[HKEY_CLASSES_ROOT\clsid\{ad3daa4e-8c03-4eeb-9926-a500ee85d639}]
[HKEY_CLASSES_ROOT\wtb.Band.1]
[HKEY_CLASSES_ROOT\TypeLib\{a5b662cc-93f1-46a2-8d11-27ea4fcbc401}]
[HKEY_CLASSES_ROOT\wtb.Band]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HW_OPENEYE_OUC_Mobile Partner"="c:\program files\Mobile Partner\UpdateDog\ouc.exe" [2009-07-27 110592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-29 335872]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-12-04 384800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"DiscWizardMonitor.exe"="c:\program files\Seagate\DiscWizard\DiscWizardMonitor.exe" [2011-06-30 2638152]
"Seagate Scheduler2 Service"="c:\program files\Common Files\Seagate\Schedule2\schedhlp.exe" [2011-06-30 395152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
MCtlSvc.lnk - c:\program files\Connect Manager\Bin\mcserver.exe [2011-7-22 63248]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmaTel StacMon]
2004-04-29 13:15 90169 ------w- c:\program files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HomeTab\\ProtectedSearch.exe"=
"c:\\Program Files\\HomeTab\\TBUpdater.dll"=
.
R0 vididr;Acronis Virtual Disk;c:\windows\system32\drivers\vididr.sys [9/11/2013 8:40 PM 125472]
R0 vidsflt53;Acronis Disk Storage Filter (53);c:\windows\system32\drivers\vsflt53.sys [9/11/2013 8:40 PM 83392]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [7/4/2013 9:40 PM 36552]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/4/2013 9:40 PM 85280]
R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files\Common Files\Seagate\Schedule2\schedul2.exe [6/30/2011 1:48 PM 845808]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [7/4/2013 10:15 PM 72832]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [6/21/2013 9:53 AM 162408]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [7/4/2013 10:15 PM 102784]
S3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [7/22/2011 10:16 AM 9216]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [7/22/2011 10:16 AM 126976]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-11-02 c:\windows\Tasks\Browser Updater.job
- c:\program files\HomeTab\TBUpdater.dll [2013-07-04 04:10]
.
2013-11-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-03 10:07]
.
2013-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-03 10:07]
.
.
------- Supplementary Scan -------
.
uStart Page = about:newtab
uDefault_Search_URL = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
mStart Page = about:newtab
mSearch Bar = hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{93be812b-478a-4c53-9a2d-cebab64b1efa} - {ad3daa4e-8c03-4eeb-9926-a500ee85d639} - c:\documents and settings\Birgitta\Application Data\HomeTab\HomeTab.dll
TCP: DhcpNameServer = 10.0.10.2 10.0.10.3
FF - ProfilePath - c:\documents and settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: !HIDDEN! 2012-09-26 14:48; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-11-21 09:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1801674531-1343024091-250163379-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ad3daa4e-8c03-4eeb-9926-a500ee85d639}]
@Denied: (A 2) (Administrators)
@Denied: (A 2) (S-1-5-21-1801674531-1343024091-250163379-1003)
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"Flags"=dword:00000400
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\Ati2evxx.exe
c:\documents and settings\Birgitta\Application Data\Mobile Partner\ouc.exe
c:\program files\Connect Manager\Bin\dbus-daemon.exe
c:\program files\Connect Manager\Bin\db_daemon.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2013-11-21 09:10:23 - machine was rebooted
ComboFix-quarantined-files.txt 2013-11-21 08:10
.
Pre-Run: 108*358*553*600 bytes free
Post-Run: 108*255*916*032 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\windows
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\windows="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 8D1D5FA4266BB1B01AED6B0709EC685E
8F558EB6672622401DA993E1E865C861 |
|
21.11.2013, 14:21
| #6 |
| /// the machine /// TB-Ausbilder | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt |
|
22.11.2013, 12:34
| #7 |
| | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Hallo hier kommts. Nach dem Durchlauf von ADWCleaner wurde Avira aktiv und schickte A0022594.dll in die Garantäne nachdem TR/Trash.Gen gemeldet wurde. # Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.21.06 Windows XP Service Pack 3 x86 NTFS Internet Explorer 6.0.2900.5512 Birgitta :: BIRGITTA-9FD6B2 [Administrator] 2013-11-21 15:36:32 mbam-log-2013-11-21 (15-36-32).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 191393 Laufzeit: 21 Minute(n), 19 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 12 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5bd13d4b-e49a-4782-a80e-7a949a06332d}_is1 (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{08b8e913-bd4e-4a50-991e-c5a24ed7c738} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{a5b662cc-93f1-46a2-8d11-27ea4fcbc401} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\wtb.SourceSinkImpl.1 (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\wtb.SourceSinkImpl (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{ad3daa4e-8c03-4eeb-9926-a500ee85d639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\wtb.Band.1 (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\wtb.Band (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 1 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{AD3DAA4E-8C03-4EEB-9926-A500EE85D639} (PUP.Optional.HomeTab.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 4 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com/) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=) Gut: (hxxp://www.google.com/) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 8 C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Local Settings\Application Data\SimplyTech\Toolbar (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\chrome (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\chrome (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\components (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\plugins (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 32 C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\home.htm (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\jquery-ui-1.10.1.custom.min.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\jquiso.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\socket.io.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\style.css (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Application Data\SimplyTech\home\vars.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Local Settings\Application Data\SimplyTech\Toolbar\settings.dat (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\Microsoft.Win32.TaskScheduler.xml (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\cinshlpr.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\hometab_icon.ico (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\InstallHelper.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\Interop.IWshRuntimeLibrary.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\Microsoft.Win32.TaskScheduler.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\ProtectedSearch.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\ProtectedSearch.ico (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\STInst32.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\STInst32.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\System.Data.SQLite.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\TaskSchedulerCreator.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\TBUpdater.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\ToolbarUninstall.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\unins000.dat (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\unins000.exe (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\chrome\HomeTab.crx (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\chrome.manifest (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\install.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\install.rdf (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\pop.htm (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\chrome\HomeTab_4028.jar (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\components\wtb_complete.js (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\HomeTab\support@HomeTab.com\plugins\npwiddit.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documents and Settings\Birgitta\Application Data\HomeTab\HomeTab.dll (PUP.Optional.HomeTab.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) --AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.012 - Report created 22/11/2013 at 09:08:48
# Updated 11/11/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Birgitta - BIRGITTA-9FD6B2
# Running from : C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\Documents and Settings\Birgitta\Local Settings\Application Data\HomeTab
Folder Deleted : C:\Documents and Settings\Birgitta\Local Settings\Application Data\SimplyTech
Folder Deleted : C:\Documents and Settings\Birgitta\Application Data\HomeTab
Folder Deleted : C:\Documents and Settings\Birgitta\Application Data\SimplyTech
File Deleted : C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\searchplugins\Web Search.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\Web Search.xml
File Deleted : C:\windows\Tasks\Browser Updater.job
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\HomeTab.DLL
Key Deleted : HKLM\SOFTWARE\Classes\wtb.NotificationSource
Key Deleted : HKLM\SOFTWARE\Classes\wtb.NotificationSource.1
Key Deleted : HKLM\SOFTWARE\Classes\wtb.ToolbarInfo
Key Deleted : HKLM\SOFTWARE\Classes\wtb.ToolbarInfo.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3FC27B34-0C19-49DA-875E-1875DDD4A6B2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A928E66C-F501-4E66-9953-855C712F93B2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\HomeTab\ProtectedSearch.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\HomeTab\TBUpdater.dll]
Key Deleted : HKCU\Software\HomeTab
Key Deleted : HKCU\Software\simplytech
Key Deleted : HKCU\Software\AppDataLow\Software\simplytech
***** [ Browsers ] *****
-\\ Internet Explorer v6.0.2900.5512
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Search [Search Bar]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Search [Search Page]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Bar]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Page]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [(Default)]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [(Default)]
-\\ Mozilla Firefox v24.0 (sv-SE)
[ File : C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\prefs.js ]
Line Deleted : user_pref("browser.search.defaultengine", "Web Search");
Line Deleted : user_pref("browser.search.defaultenginename", "Web Search");
Line Deleted : user_pref("browser.search.order.1", "Web Search");
Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");
Line Deleted : user_pref("keyword.URL", "hxxp://search.certified-toolbar.com?si=46366&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&st=chrome&q=");
*************************
AdwCleaner[R0].txt - [5016 octets] - [22/11/2013 08:44:27]
AdwCleaner[S0].txt - [3993 octets] - [22/11/2013 09:08:48]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4053 octets] ##########
-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.8 (11.05.2013:1) OS: Microsoft Windows XP x86 Ran by Birgitta on 2013-11-22 at 10:47:15,30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\apn" Successfully deleted: [Folder] "C:\Program Files\coupons" ~~~ FireFox Emptied folder: C:\Documents and Settings\Birgitta\Application Data\mozilla\firefox\profiles\qpp52zv4.default\minidumps [3 files] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 2013-11-22 at 11:19:55,12 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by Birgitta (administrator) on BIRGITTA-9FD6B2 on 22-11-2013 12:01:36
Running from C:\Documents and Settings\Birgitta\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 6
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
() C:\windows\system32\Ati2evxx.exe
() C:\windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\windows\System32\bcmwltry.exe
(Microsoft Corporation) C:\windows\System32\SCardSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\windows\system32\Ati2evxx.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dell Inc.) C:\WINDOWS\system32\WLTRAY.exe
(Seagate) C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ZTE) C:\Program Files\Connect Manager\Bin\mcserver.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\ouc.exe
(Microsoft Corporation) C:\windows\system32\cmd.exe
() C:\Program Files\Connect Manager\Bin\dbus-daemon.exe
() C:\Program Files\Connect Manager\Bin\db_daemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\windows\system32\wscntfy.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST(1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ATIModeChange] - C:\WINDOWS\system32\Ati2mdxx.exe [28672 2001-09-04] (ATI Technologies, Inc.)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [335872 2003-07-29] (ATI Technologies, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [384800 2012-12-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\WINDOWS\system32\WLTRAY.EXE [1347584 2005-12-19] (Dell Inc.)
HKLM\...\Run: [DiscWizardMonitor.exe] - C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [2638152 2011-06-30] (Seagate)
HKLM\...\Run: [Seagate Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395152 2011-06-30] (Seagate)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll ()
HKCU\...\Run: [HW_OPENEYE_OUC_Mobile Partner] - C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [110592 2009-07-27] (Huawei Technologies Co., Ltd.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MCtlSvc.lnk
ShortcutTarget: MCtlSvc.lnk -> C:\Program Files\Connect Manager\Bin\mcserver.exe (ZTE)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1372873530110
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.10.2 10.0.10.3
FireFox:
========
FF ProfilePath: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default
FF NewTab: about:home
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml
FF Extension: No Name - C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [85280 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [109344 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [323584 2003-07-29] ()
R2 SgtSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [845808 2011-06-30] (Seagate)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [1200128 2005-12-19] (Dell Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83944 2012-11-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134336 2012-11-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36552 2012-11-22] (Avira Operations GmbH & Co. KG)
R3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl5.sys [424320 2005-11-02] (Broadcom Corporation)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
R3 HSFHWICH; C:\Windows\System32\DRIVERS\HSFHWICH.sys [189056 2003-07-03] (Conexant Systems, Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-09] (MBB Incorporated)
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscr.sys [91395 2003-12-11] (O2Micro)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 STAC97; C:\Windows\System32\drivers\stac97.sys [258704 2004-05-12] (SigmaTel, Inc.)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [125472 2013-09-11] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [83392 2013-09-11] (Acronis)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [126976 2011-03-09] (ZTE Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [117504 2010-08-27] (Huawei Technologies Co., Ltd.)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-22 11:58 - 2013-11-22 11:57 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST(1).exe
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 08:43 - 2013-11-22 09:08 - 00000000 ____D C:\AdwCleaner
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 11:12 - 2013-11-22 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2013-09-12 20:41 - 00000211 _____ C:\Boot.bak
2013-11-21 08:38 - 2004-08-03 23:00 - 00260272 __RSH C:\cmldr
2013-11-21 08:32 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2013-11-21 08:32 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2013-11-21 08:32 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2013-11-21 08:31 - 2013-11-21 09:10 - 00000000 ____D C:\Qoobox
2013-11-21 08:30 - 2013-11-21 09:05 - 00000000 ____D C:\windows\erdnt
2013-11-21 08:23 - 2013-11-21 08:22 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-19 14:39 - 2013-11-19 14:42 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:34 - 2013-11-22 12:02 - 00011788 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
==================== One Month Modified Files and Folders =======
2013-11-22 12:02 - 2013-11-19 14:34 - 00011788 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-22 12:00 - 2012-04-03 11:08 - 00000986 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-22 11:58 - 2012-04-03 11:08 - 00000982 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-22 11:57 - 2013-11-22 11:58 - 01090881 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST(1).exe
2013-11-22 11:57 - 2011-07-22 11:17 - 00000000 ____D C:\Documents and Settings\Birgitta\My Documents\Hämtade filer
2013-11-22 11:44 - 2013-11-21 11:12 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-22 11:43 - 2013-01-30 09:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 09:14 - 2003-05-29 02:32 - 00548064 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-22 09:11 - 2011-07-22 09:50 - 01918209 _____ C:\windows\WindowsUpdate.log
2013-11-22 09:10 - 2011-07-22 09:59 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-22 09:09 - 2011-07-22 10:00 - 00000178 ___SH C:\Documents and Settings\Birgitta\ntuser.ini
2013-11-22 09:09 - 2011-07-22 10:00 - 00000000 ____D C:\Documents and Settings\Birgitta
2013-11-22 09:09 - 2011-07-22 09:59 - 00032638 _____ C:\windows\SchedLgU.Txt
2013-11-22 09:08 - 2013-11-22 08:43 - 00000000 ____D C:\AdwCleaner
2013-11-21 16:00 - 2013-07-03 19:17 - 00000000 __HDC C:\windows\$NtServicePackUninstall$
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:10 - 2013-11-21 08:31 - 00000000 ____D C:\Qoobox
2013-11-21 09:10 - 2011-07-22 09:59 - 00000000 __SHD C:\Documents and Settings\LocalService
2013-11-21 09:10 - 2011-07-22 09:58 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-11-21 09:05 - 2013-11-21 08:30 - 00000000 ____D C:\windows\erdnt
2013-11-21 09:02 - 2004-08-04 11:00 - 00000227 _____ C:\windows\system.ini
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 26214400 _____ C:\windows\system32\config\software.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 06815744 _____ C:\windows\system32\config\system.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 00262144 _____ C:\windows\system32\config\default.bak
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2003-05-29 02:30 - 00000327 __RSH C:\boot.ini
2013-11-21 08:22 - 2013-11-21 08:23 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-21 08:19 - 2004-08-04 11:00 - 00002206 _____ C:\windows\system32\wpa.dbl
2013-11-19 14:42 - 2013-11-19 14:39 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
2013-11-02 08:38 - 2013-07-04 22:25 - 00000000 ____D C:\Documents and Settings\Birgitta\Local Settings\Application Data\Adobe
2013-11-02 08:38 - 2011-07-22 10:56 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Adobe
2013-11-01 07:58 - 2013-09-15 00:43 - 00000000 ____D C:\windows\system32\NtmsData
2013-11-01 07:57 - 2011-07-22 09:48 - 00000000 ____D C:\windows\Registration
Some content of TEMP:
====================
C:\Documents and Settings\Birgitta\Local Settings\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2004-08-04 11:00] - [2008-04-14 05:42] - 0108544 ____A (Microsoft Corporation) 0e776ed5f7cc9f94299e70461b7b8185
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
--- --- --- -- |
|
23.11.2013, 07:24
| #8 |
| /// the machine /// TB-Ausbilder | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingtESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.12.2013, 13:52
| #9 |
| | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Hier kommen die logs. Das Problem mit dem Firefox scheint behoben, oder siehst Du noch etwas? ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=5eff0dd5956020468397dc3458d652c6 # engine=16138 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-12-05 12:30:39 # local_time=2013-12-05 01:30:39 (+0100, W. Europe Standard Time) # country="Sweden" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=1023 16777215 0 0 0 0 0 0 # compatibility_mode=1799 16774141 100 97 13233007 156874744 0 0 # scanned=33753 # found=0 # cleaned=0 # scan_time=10274 -- Results of screen317's Security Check version 0.99.76 Windows XP Service Pack 3 x86 Internet Explorer 6 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Avira Desktop Antivirus out of date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.8.800.168 Adobe Reader XI Mozilla Firefox (25.0.1) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: 14% Defragment your hard drive soon! (Do NOT defrag if SSD!) ````````````````````End of Log`````````````````````` -- -- FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-12-2013 01
Ran by Birgitta (administrator) on BIRGITTA-9FD6B2 on 05-12-2013 12:08:47
Running from C:\Documents and Settings\Birgitta\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 6
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
() C:\WINDOWS\system32\ati2evxx.exe
() C:\WINDOWS\system32\WLTRYSVC.EXE
(Dell Inc.) C:\WINDOWS\system32\BCMWLTRY.EXE
(Microsoft Corporation) C:\WINDOWS\system32\scardsvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dell Inc.) C:\WINDOWS\system32\WLTRAY.EXE
(Seagate) C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ZTE) C:\Program Files\Connect Manager\Bin\mcserver.exe
(Huawei Technologies Co., Ltd.) C:\Documents and Settings\Birgitta\Application Data\Mobile Partner\ouc.exe
(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe
() C:\Program Files\Connect Manager\Bin\dbus-daemon.exe
() C:\Program Files\Connect Manager\Bin\db_daemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ATIModeChange] - C:\WINDOWS\system32\Ati2mdxx.exe [28672 2001-09-04] (ATI Technologies, Inc.)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [335872 2003-07-29] (ATI Technologies, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [384800 2012-12-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\WINDOWS\system32\WLTRAY.EXE [1347584 2005-12-19] (Dell Inc.)
HKLM\...\Run: [DiscWizardMonitor.exe] - C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [2638152 2011-06-30] (Seagate)
HKLM\...\Run: [Seagate Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395152 2011-06-30] (Seagate)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll ()
HKCU\...\Run: [HW_OPENEYE_OUC_Mobile Partner] - C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [110592 2009-07-27] (Huawei Technologies Co., Ltd.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MCtlSvc.lnk
ShortcutTarget: MCtlSvc.lnk -> C:\Program Files\Connect Manager\Bin\mcserver.exe (ZTE)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1372873530110
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll [8461312 2008-04-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.0.10.2 10.0.10.3
FireFox:
========
FF ProfilePath: C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default
FF NewTab: about:home
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml
FF Extension: No Name - C:\Documents and Settings\Birgitta\Application Data\Mozilla\Firefox\Profiles\qpp52zv4.default\Extensions\WTB_GLOBAL.sqlite
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [85280 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [109344 2012-12-04] (Avira Operations GmbH & Co. KG)
R2 Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [323584 2003-07-29] ()
R2 SgtSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [845808 2011-06-30] (Seagate)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [1200128 2005-12-19] (Dell Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83944 2012-11-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134336 2012-11-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36552 2012-11-22] (Avira Operations GmbH & Co. KG)
R3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl5.sys [424320 2005-11-02] (Broadcom Corporation)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
R3 HSFHWICH; C:\Windows\System32\DRIVERS\HSFHWICH.sys [189056 2003-07-03] (Conexant Systems, Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-09] (MBB Incorporated)
R3 O2SCBUS; C:\Windows\System32\DRIVERS\ozscr.sys [91395 2003-12-11] (O2Micro)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 STAC97; C:\Windows\System32\drivers\stac97.sys [258704 2004-05-12] (SigmaTel, Inc.)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [125472 2013-09-11] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [83392 2013-09-11] (Acronis)
S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [126976 2011-03-09] (ZTE Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [117504 2010-08-27] (Huawei Technologies Co., Ltd.)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-05 12:07 - 2013-12-05 12:08 - 01092683 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-12-05 10:38 - 2013-12-05 10:38 - 00001012 _____ C:\Documents and Settings\Birgitta\Desktop\security_check_2.txt
2013-12-05 10:31 - 2013-12-05 10:31 - 00001171 _____ C:\Documents and Settings\Birgitta\Desktop\security_check.txt
2013-12-04 17:46 - 2013-12-04 17:46 - 00891184 _____ C:\Documents and Settings\Birgitta\Desktop\SecurityCheck.exe
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 08:43 - 2013-11-22 09:08 - 00000000 ____D C:\AdwCleaner
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 11:12 - 2013-11-22 11:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2013-09-12 20:41 - 00000211 _____ C:\Boot.bak
2013-11-21 08:38 - 2004-08-03 23:00 - 00260272 __RSH C:\cmldr
2013-11-21 08:32 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2013-11-21 08:32 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2013-11-21 08:32 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2013-11-21 08:32 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2013-11-21 08:31 - 2013-11-21 09:10 - 00000000 ____D C:\Qoobox
2013-11-21 08:30 - 2013-11-21 09:05 - 00000000 ____D C:\windows\erdnt
2013-11-21 08:23 - 2013-11-21 08:22 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-19 14:39 - 2013-11-19 14:42 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:34 - 2013-12-05 12:09 - 00011630 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
==================== One Month Modified Files and Folders =======
2013-12-05 12:09 - 2013-11-19 14:34 - 00011630 _____ C:\Documents and Settings\Birgitta\Desktop\FRST.txt
2013-12-05 12:08 - 2013-12-05 12:07 - 01092683 _____ (Farbar) C:\Documents and Settings\Birgitta\Desktop\FRST.exe
2013-12-05 12:00 - 2012-04-03 11:08 - 00000986 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-05 11:58 - 2012-04-03 11:08 - 00000982 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-05 10:38 - 2013-12-05 10:38 - 00001012 _____ C:\Documents and Settings\Birgitta\Desktop\security_check_2.txt
2013-12-05 10:34 - 2011-07-22 09:50 - 02040235 _____ C:\windows\WindowsUpdate.log
2013-12-05 10:33 - 2003-05-29 02:32 - 00548064 _____ C:\windows\system32\PerfStringBackup.INI
2013-12-05 10:31 - 2013-12-05 10:31 - 00001171 _____ C:\Documents and Settings\Birgitta\Desktop\security_check.txt
2013-12-05 10:27 - 2011-07-22 09:59 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-12-05 06:39 - 2011-07-22 10:00 - 00000178 ___SH C:\Documents and Settings\Birgitta\ntuser.ini
2013-12-05 06:39 - 2011-07-22 10:00 - 00000000 ____D C:\Documents and Settings\Birgitta
2013-12-05 06:39 - 2011-07-22 09:59 - 00032638 _____ C:\windows\SchedLgU.Txt
2013-12-04 22:27 - 2011-07-22 09:58 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-12-04 17:49 - 2011-07-22 11:17 - 00000000 ____D C:\Documents and Settings\Birgitta\My Documents\Hämtade filer
2013-12-04 17:46 - 2013-12-04 17:46 - 00891184 _____ C:\Documents and Settings\Birgitta\Desktop\SecurityCheck.exe
2013-12-04 17:38 - 2013-01-30 09:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-04 17:38 - 2011-07-22 09:59 - 00000000 __SHD C:\Documents and Settings\LocalService
2013-12-04 17:38 - 2004-08-04 11:00 - 00002206 _____ C:\windows\system32\wpa.dbl
2013-11-22 11:44 - 2013-11-21 11:12 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-22 11:19 - 2013-11-22 11:19 - 00000888 _____ C:\Documents and Settings\Birgitta\Desktop\JRT.txt
2013-11-22 10:46 - 2013-11-22 10:46 - 00000000 ____D C:\windows\ERUNT
2013-11-22 09:08 - 2013-11-22 08:43 - 00000000 ____D C:\AdwCleaner
2013-11-21 16:00 - 2013-07-03 19:17 - 00000000 __HDC C:\windows\$NtServicePackUninstall$
2013-11-21 15:30 - 2013-11-21 15:30 - 00000000 ____D C:\Documents and Settings\Birgitta\Application Data\Malwarebytes
2013-11-21 15:29 - 2013-11-21 15:29 - 00000784 _____ C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-11-21 15:29 - 2013-11-21 15:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-11-21 15:28 - 2013-11-21 15:28 - 01034531 _____ (Thisisu) C:\Documents and Settings\Birgitta\Desktop\JRT.exe
2013-11-21 15:27 - 2013-11-21 15:27 - 01085542 _____ C:\Documents and Settings\Birgitta\Desktop\adwcleaner.exe
2013-11-21 13:58 - 2013-11-21 13:58 - 00001126 _____ C:\windows\setupapi.log
2013-11-21 09:10 - 2013-11-21 09:10 - 00010976 _____ C:\ComboFix.txt
2013-11-21 09:10 - 2013-11-21 08:31 - 00000000 ____D C:\Qoobox
2013-11-21 09:05 - 2013-11-21 08:30 - 00000000 ____D C:\windows\erdnt
2013-11-21 09:02 - 2004-08-04 11:00 - 00000227 _____ C:\windows\system.ini
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\SECURITY.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00008192 ____H C:\windows\system32\config\default.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\system.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\software.tmp.LOG
2013-11-21 09:01 - 2013-11-21 09:01 - 00000000 ____H C:\windows\system32\config\SAM.tmp.LOG
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-11-21 09:01 - 2003-05-29 02:30 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 26214400 _____ C:\windows\system32\config\software.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 06815744 _____ C:\windows\system32\config\system.bak
2013-11-21 09:01 - 2003-05-29 02:29 - 00262144 _____ C:\windows\system32\config\default.bak
2013-11-21 08:38 - 2013-11-21 08:38 - 00000000 _RSHD C:\cmdcons
2013-11-21 08:38 - 2003-05-29 02:30 - 00000327 __RSH C:\boot.ini
2013-11-21 08:22 - 2013-11-21 08:23 - 05146522 ____R (Swearware) C:\Documents and Settings\Birgitta\Desktop\ComboFix.exe
2013-11-19 14:42 - 2013-11-19 14:39 - 00013854 _____ C:\Documents and Settings\Birgitta\Desktop\Addition.txt
2013-11-19 14:33 - 2013-11-19 14:33 - 00000000 ____D C:\FRST
Some content of TEMP:
====================
C:\Documents and Settings\Birgitta\Local Settings\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2004-08-04 11:00] - [2008-04-14 05:42] - 0108544 ____A (Microsoft Corporation) 0e776ed5f7cc9f94299e70461b7b8185
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
|
|
06.12.2013, 10:04
| #10 |
| /// the machine /// TB-Ausbilder | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Windows und IE updaten, Flash updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms}
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.12.2013, 14:25
| #11 |
| | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Leider funktioniert das mit dem Updaten nicht. Windows hat nach einem Reperaturversuchs von "Windows Update" die Update Funktionen rausgeworfen und jetzt funktioniert das Updaten nicht mehr. Auch bei den anderen Programmen wie Acrobat etc scheinen die Automatikfunktionen nicht "mehr" vorhanden zu sein. |
|
21.12.2013, 12:07
| #12 |
| /// the machine /// TB-Ausbilder | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Downloade dir bitte Windows Repair (All In One) von hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.12.2013, 16:17
| #13 |
| | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Hallo, es kann ja ein zeitlicher Zufall sein, aber beim Entpacken des heruntergeladenen Zips meldete sich Avira mit: C:\Documents and Settings\...\vss_start.exe enthält 'TR/Dropper.Gen' was blocked. Ich habe dann auch Remove geklickt. Ich setze jetzt mit der von Dir genannten Reperatur fort... Das Aussehen des "starts repair" ist anders. Außerdem will das Programm die Registry sichern was aber nicht gehen will, da ein anderer Process zu "busy" ist und dann friert das Programm ein. Was soll ich jetzt tun? |
|
23.12.2013, 09:02
| #14 |
| /// the machine /// TB-Ausbilder | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Überspring das alles. Am Schluss auf Start klicken, dann die Häkchen setzen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.01.2014, 16:12
| #15 |
| | Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt Hier ist das Fixlist Protokoll: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-01-2014 01 Ran by Birgitta at 2014-01-03 16:11:27 Run:1 Running from C:\Documents and Settings\Birgitta\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms} SearchScopes: HKLM - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms} SearchScopes: HKLM - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms} SearchScopes: HKCU - URL hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms} SearchScopes: HKCU - SuggestionsURL_JSON hxxp://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=46366&gid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&dbCode=1&command={searchTerms} SearchScopes: HKCU - TopResultURLFallback hxxp://search.certified-toolbar.com?si=46366&st=bs&tid=4028&ver=4.8&ts=1372969504934.000003&tguid=46366-4028-1372969504934-50042E94E77C91F953E30FE439653CAA&q={searchTerms} ***************** HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\TopResultURLFallback => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\TopResultURLFallback => Value deleted successfully. ==== End of Fixlog ==== |
|
| Themen zu Windows XP, schwedisch, Firefox, certified toolbar entfernen misslingt |
| abstellen, angegeben, betreff, certified toolbar, deutsche, entfernen, firefox, hijack.searchpage, installieren, programme, pup.optional.hometab.a, sprache, systems, systemsteuerung, toolbar, toolbar entfernen, tr/trash.gen, windows, windows xp |
WARNUNG an die MITLESER: 
Linear-Darstellung
