| |
| |||||||
Log-Analyse und Auswertung: Firefox öffnet unter WIN 7 auch bei mir immer static.icmapp.comWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
26.11.2013, 23:19
| #1 |
| |  Firefox öffnet unter WIN 7 auch bei mir immer static.icmapp.com Hallo! Seit ein paar Tagen öffnet sich der Firefox immer in einem neuen leeren Fenster wenn ich einen Link angeklickt habe. Die Adresse lautet hxxp://static.icmapp.com (und dann ein Rattenschwanz dran). Der avast hat nichts gefunden, die logfiles von avast finde ich nicht, bzw. unter C:ProgramData/Avast Software/Avast/log gibt es ganz viele Dateien mit der Endung log. Hier müsste ich wissen welche benötigt wird. --------------- Das defogger log ergab folgendes: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:57 on 26/11/2013 (Zus)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Das FRST log ergab folgendes: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-11-2013 01
Ran by Asta (ATTENTION: The logged in user is not administrator) on ZUS-PC on 26-11-2013 20:10:51
Running from C:\Users\Asta\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM\...\Run: [20131121] - C:\Program Files\AVAST Software\Avast\Setup\emupdate\588a4768-387b-495d-a800-a75c8409b5dd.exe [180184 2013-11-23] (AVAST Software)
HKLM\...\Runonce: [aswAhAScr.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\AhAScr.dll"
HKLM\...\Runonce: [aswasOutExt.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\asOutExt.dll"
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x090CE3C70D15CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
BHO: Plus-HD-3.8 - {11111111-1111-1111-1111-110311901130} - C:\Program Files\Plus-HD-3.8\Plus-HD-3.8-bho.dll (Plus HD)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: HomeTab - {a25e7121-3dd8-41b3-855b-756c5bc45449} - C:\Users\Zus\AppData\Roaming\HomeTab\HomeTab.dll (Simply Tech Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - HomeTab - {a25e7121-3dd8-41b3-855b-756c5bc45449} - C:\Users\Zus\AppData\Roaming\HomeTab\HomeTab.dll (Simply Tech Ltd.)
Tcpip\Parameters: [DhcpNameServer] 62.109.121.2 62.109.121.1
FireFox:
========
FF ProfilePath: C:\Users\Asta\AppData\Roaming\Mozilla\Firefox\Profiles\344omg63.default
FF NewTab: about:home
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Plus-HD-3.8 - C:\Users\Asta\AppData\Roaming\Mozilla\Firefox\Profiles\344omg63.default\Extensions\c17236e8-fd66-44bc-aeef-1e00981cbb64@0a4ee0fe-5356-4fd3-b37c-5cd5671a315c.com
FF Extension: No Name - C:\Users\Asta\AppData\Roaming\Mozilla\Firefox\Profiles\344omg63.default\Extensions\WTB_GLOBAL.sqlite
FF Extension: Adblock Plus - C:\Users\Asta\AppData\Roaming\Mozilla\Firefox\Profiles\344omg63.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (HomeTab) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\bddpogknpjlgfpbboediomaiiaecfajn\4.4_0
CHR Extension: (YouTube) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (avast! Online Security) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2005.45_0
CHR Extension: (Google Wallet) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Asta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [bddpogknpjlgfpbboediomaiiaecfajn] - C:\Program Files\HomeTab\chrome\HomeTab.crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
========================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 MySQL56; C:\ProgramData\MySQL\MySQL Server 5.6\my.ini [14239 2013-05-24] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)
S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)
S3 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [229520 2011-12-08] (soft Xpansion)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [35656 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2013-11-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [79720 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49944 2013-11-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [774392 2013-11-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [403440 2013-11-20] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57672 2013-11-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [178304 2013-11-20] ()
S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [49016 2011-10-10] (G Data Software AG)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-04-18] (Secunia)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-26 20:10 - 2013-11-26 20:11 - 00009156 _____ C:\Users\Asta\Desktop\FRST.txt
2013-11-26 20:10 - 2013-11-26 20:10 - 00000000 ____D C:\FRST
2013-11-26 20:07 - 2013-11-26 20:08 - 01091605 _____ (Farbar) C:\Users\Asta\Desktop\FRST.exe
2013-11-26 19:57 - 2013-11-26 19:57 - 00000000 _____ C:\Users\Zus\defogger_reenable
2013-11-26 19:54 - 2013-11-26 20:09 - 00000000 ____D C:\Users\Asta\Documents\Trojaner Board
2013-11-26 03:34 - 2013-11-26 03:34 - 00014930 _____ C:\Users\Asta\Documents\Waage.odt
2013-11-22 00:28 - 2013-11-22 00:28 - 00002193 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-22 00:26 - 2013-11-22 00:28 - 00000000 ____D C:\Users\Asta\AppData\Local\Google
2013-11-22 00:25 - 2013-11-22 00:26 - 00000000 ____D C:\Users\Asta\AppData\Local\Deployment
2013-11-22 00:25 - 2013-11-22 00:25 - 00000000 ____D C:\Users\Asta\AppData\Local\Apps\2.0
2013-11-20 21:47 - 2013-11-20 21:47 - 00000000 ____D C:\Users\Asta\AppData\Roaming\AVAST Software
2013-11-17 20:00 - 2013-11-17 20:00 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 20:00 - 2013-11-17 20:00 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-17 20:00 - 2013-11-17 20:00 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-17 20:00 - 2013-11-17 20:00 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-17 20:00 - 2013-11-17 20:00 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-17 20:00 - 2013-11-17 20:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-17 19:59 - 2013-11-17 20:06 - 00010261 _____ C:\Windows\IE11_main.log
2013-11-17 03:54 - 2013-11-17 03:00 - 00632603 _____ C:\Windows\system32\sqlite3.dll
2013-11-17 03:54 - 2013-11-17 03:00 - 00004415 _____ C:\Windows\system32\sqlite3.def
2013-11-15 23:25 - 2013-11-15 23:26 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-13 17:52 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 17:52 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 17:52 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 17:51 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 17:51 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 17:51 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 17:51 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 17:51 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 17:51 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 17:51 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 17:51 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 17:51 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 17:51 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 17:51 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 17:51 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 17:51 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 17:51 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 17:51 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
==================== One Month Modified Files and Folders =======
2013-11-26 20:11 - 2013-11-26 20:10 - 00009156 _____ C:\Users\Asta\Desktop\FRST.txt
2013-11-26 20:11 - 2012-08-29 02:21 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-26 20:10 - 2013-11-26 20:10 - 00000000 ____D C:\FRST
2013-11-26 20:09 - 2013-11-26 19:54 - 00000000 ____D C:\Users\Asta\Documents\Trojaner Board
2013-11-26 20:08 - 2013-11-26 20:07 - 01091605 _____ (Farbar) C:\Users\Asta\Desktop\FRST.exe
2013-11-26 20:04 - 2009-07-14 05:34 - 00013760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-26 20:04 - 2009-07-14 05:34 - 00013760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-26 20:02 - 2011-11-11 18:04 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-26 19:57 - 2013-11-26 19:57 - 00000000 _____ C:\Users\Zus\defogger_reenable
2013-11-26 19:57 - 2011-10-10 17:14 - 00000000 ____D C:\Users\Zus
2013-11-26 19:40 - 2013-09-29 18:40 - 00001274 _____ C:\Windows\Tasks\Plus-HD-3.8-updater.job
2013-11-26 19:39 - 2013-09-29 18:39 - 00001180 _____ C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job
2013-11-26 19:39 - 2013-09-29 18:39 - 00001078 _____ C:\Windows\Tasks\Plus-HD-3.8-enabler.job
2013-11-26 19:38 - 2013-09-29 18:38 - 00001800 _____ C:\Windows\Tasks\Plus-HD-3.8-firefoxinstaller.job
2013-11-26 19:38 - 2013-05-21 21:25 - 00000000 ____D C:\Users\Asta\AppData\Local\TSVNCache
2013-11-26 19:38 - 2011-11-11 18:04 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-26 19:28 - 2011-10-10 17:06 - 01165080 _____ C:\Windows\WindowsUpdate.log
2013-11-26 17:40 - 2011-10-10 17:21 - 01500256 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-26 17:32 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-26 17:32 - 2009-07-14 05:39 - 00038707 _____ C:\Windows\setupact.log
2013-11-26 03:34 - 2013-11-26 03:34 - 00014930 _____ C:\Users\Asta\Documents\Waage.odt
2013-11-25 18:43 - 2011-10-29 16:05 - 00466809 _____ C:\Users\Asta\Desktop\Ausgaben + Kalorien 2010 03 01 Libreoffice.ods
2013-11-22 17:37 - 2011-10-10 18:49 - 00452526 _____ C:\Windows\PFRO.log
2013-11-22 00:28 - 2013-11-22 00:28 - 00002193 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-22 00:28 - 2013-11-22 00:26 - 00000000 ____D C:\Users\Asta\AppData\Local\Google
2013-11-22 00:27 - 2011-11-11 18:04 - 00000000 ____D C:\Program Files\Google
2013-11-22 00:26 - 2013-11-22 00:25 - 00000000 ____D C:\Users\Asta\AppData\Local\Deployment
2013-11-22 00:25 - 2013-11-22 00:25 - 00000000 ____D C:\Users\Asta\AppData\Local\Apps\2.0
2013-11-22 00:17 - 2012-04-16 16:40 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-11-22 00:17 - 2011-11-11 18:10 - 00000000 ____D C:\Users\Zus\AppData\Local\Adobe
2013-11-22 00:17 - 2011-10-12 17:11 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-20 21:47 - 2013-11-20 21:47 - 00000000 ____D C:\Users\Asta\AppData\Roaming\AVAST Software
2013-11-20 21:46 - 2009-07-14 05:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-20 20:59 - 2013-03-15 17:25 - 00178304 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-11-20 20:59 - 2013-03-15 17:25 - 00049944 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-11-20 20:59 - 2012-02-25 17:29 - 00079720 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-11-20 20:59 - 2011-11-11 18:04 - 00774392 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-11-20 20:59 - 2011-11-11 18:04 - 00403440 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-11-20 20:59 - 2011-11-11 18:04 - 00269216 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-11-20 20:59 - 2011-11-11 18:04 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-11-20 20:59 - 2011-11-11 18:04 - 00057672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-11-20 20:59 - 2011-11-11 18:04 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-11-20 20:59 - 2011-11-11 18:04 - 00035656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-11-20 20:59 - 2011-11-11 18:04 - 00002047 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-11-20 20:52 - 2011-11-11 18:03 - 00000000 ____D C:\ProgramData\AVAST Software
2013-11-20 20:52 - 2009-07-14 03:04 - 00002577 _____ C:\Windows\system32\config.nt
2013-11-18 00:51 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-11-17 20:31 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-17 20:06 - 2013-11-17 19:59 - 00010261 _____ C:\Windows\IE11_main.log
2013-11-17 20:00 - 2013-11-17 20:00 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 20:00 - 2013-11-17 20:00 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-17 20:00 - 2013-11-17 20:00 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-17 20:00 - 2013-11-17 20:00 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-17 20:00 - 2013-11-17 20:00 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-17 20:00 - 2013-11-17 20:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-17 20:00 - 2013-11-17 20:00 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-17 20:00 - 2013-11-17 20:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-17 18:15 - 2013-07-13 21:24 - 00000000 ____D C:\Users\Asta\Documents\Adobe Flash Player
2013-11-17 17:58 - 2013-07-31 19:36 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2013-11-17 17:55 - 2013-06-13 15:55 - 00000000 ____D C:\Users\Asta\Documents\Adobe Air
2013-11-17 03:00 - 2013-11-17 03:54 - 00632603 _____ C:\Windows\system32\sqlite3.dll
2013-11-17 03:00 - 2013-11-17 03:54 - 00004415 _____ C:\Windows\system32\sqlite3.def
2013-11-17 02:34 - 2011-10-11 15:53 - 00000000 ____D C:\Users\Asta\Documents\Lazarus
2013-11-16 17:13 - 2013-10-12 01:16 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-15 23:26 - 2013-11-15 23:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-15 00:25 - 2013-02-03 17:02 - 00000000 ____D C:\Users\Asta\Documents\Ba
2013-11-13 18:04 - 2013-08-12 18:49 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 18:00 - 2011-10-10 17:34 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-11 05:50 - 2011-10-10 17:29 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-10 00:47 - 2013-08-11 01:33 - 15922623 _____ C:\Users\Asta\Desktop\project_0054.exe
2013-11-04 20:05 - 2011-10-31 19:20 - 00087242 _____ C:\Users\Asta\Desktop\HAD .ods
2013-11-03 00:25 - 2011-10-11 18:52 - 00000000 ____D C:\Users\Asta\AppData\Local\lazarus
2013-11-02 20:01 - 2009-07-14 09:56 - 00000000 ___RD C:\Users\Public\Recorded TV
Some content of TEMP:
====================
C:\Users\Asta\AppData\Local\Temp\apptorun.exe
C:\Users\Asta\AppData\Local\Temp\install_flashplayer11x32_mssd_aaa_aih.exe
C:\Users\Asta\AppData\Local\Temp\install_flashplayer11x32_mssd_aih.exe
C:\Users\Asta\AppData\Local\Temp\install_flashplayer11x32_mssd_aih_1.exe
C:\Users\Asta\AppData\Local\Temp\install_reader11_de_mssd_aih.exe
C:\Users\Asta\AppData\Local\Temp\jna3704815889008915635.hunspell-win-x86-32.dll
C:\Users\Asta\AppData\Local\Temp\jna5025217690866461702.hunspell-win-x86-32.dll
C:\Users\Asta\AppData\Local\Temp\jna6926705884650915026.hunspell-win-x86-32.dll
C:\Users\Asta\AppData\Local\Temp\JREInstall??.exe
C:\Users\Asta\AppData\Local\Temp\project1.exe
C:\Users\Zus\AppData\Local\Temp\borlndlm.dll
C:\Users\Zus\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Zus\AppData\Local\Temp\project1.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
Additional ergab folgendes: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 25-11-2013 01
Ran by Asta at 2013-11-26 20:11:56
Running from C:\Users\Asta\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
7Burn 2.0 (Version: 2.0.0)
7-Zip 9.20
Adobe AIR (Version: 3.9.0.1210)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.152)
Adobe Flash Player 11 Plugin (Version: 11.9.900.152)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.4.144)
Apple Application Support (Version: 2.3.4)
Apple Software Update (Version: 2.1.3.127)
Ashampoo Burning Studio 6 FREE v.6.83 (Version: 6.8.3)
avast! Free Antivirus (Version: 9.0.2008)
CDBurnerXP (Version: 4.5.2.4214)
DP Hash 1.0 (Version: 1.0)
FreeBASIC 0.24.0 (HKCU Version: 0.24.0)
GIMP 2.8.4 (Version: 2.8.4)
Google Chrome (Version: 31.0.1650.57)
Google Update Helper (Version: 1.3.21.165)
HomeTab 4.4 (Version: 4.4)
IrfanView (remove only) (Version: 4.36)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
Lazarus 1.0.8 (HKCU Version: 1.0.8)
Lazarus 1.0.8 (Version: 1.0.8)
LibreOffice 4.0.3.3 (Version: 4.0.3.3)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (Version: 10.0.30319)
Mozilla Firefox 25.0.1 (x86 de) (Version: 25.0.1)
Mozilla Maintenance Service (Version: 25.0.1)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
MySQL Connector C++ 1.1.2 (Version: 1.1.2)
MySQL Connector J (Version: 5.1.23)
MySQL Connector Net 6.6.5 (Version: 6.6.5)
MySQL Connector/ODBC 5.2(w) (Version: 5.2.4)
MySQL Documents 5.6 (Version: 5.6.10)
MySQL Examples and Samples 5.6 (Version: 5.6.10)
MySQL Installer (Version: 1.1.7.0)
MySQL Notifier 1.0.3 (Version: 1.0.3)
MySQL Server 5.6 (Version: 5.6.10)
MySQL Workbench 5.2 CE (Version: 5.2.47)
phase-6 2.3.3 (Version: 2.3.3)
Plus-HD-3.8 (Version: 1.27.153.11) <==== ATTENTION
QuickTime (Version: 7.74.80.86)
Secunia PSI (3.0.0.7009) (Version: 3.0.0.7009)
StarMoney (Version: 2.0)
swMSM (Version: 12.0.0.1)
TortoiseSVN 1.7.12.24070 (32 bit) (Version: 1.7.24070)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
==================== Restore Points =========================
Could not list Restore Points. Check WMI.
==================== Hosts content: ==========================
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
Task: C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job => ?
Task: C:\Windows\Tasks\Plus-HD-3.8-enabler.job => ?
Task: C:\Windows\Tasks\Plus-HD-3.8-firefoxinstaller.job => ?
Task: C:\Windows\Tasks\Plus-HD-3.8-updater.job => ?
==================== Loaded Modules (whitelisted) =============
2013-03-29 08:17 - 2013-03-29 08:17 - 00070536 _____ () C:\Program Files\TortoiseSVN\bin\libsasl32.dll
2013-11-20 20:59 - 2013-11-20 20:59 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-11-15 23:25 - 2013-11-15 23:26 - 03363952 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-11-17 18:16 - 2013-11-17 18:16 - 16237448 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_152.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/26/2013 07:29:49 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 25.0.1.5064, Zeitstempel: 0x5282f204
Name des fehlerhaften Moduls: xul.dll, Version: 25.0.1.5064, Zeitstempel: 0x5282f10e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00118f87
ID des fehlerhaften Prozesses: 0xc08
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (11/26/2013 05:37:54 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).
Error: (11/25/2013 05:59:08 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).
Error: (11/24/2013 04:07:54 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).
Error: (11/22/2013 06:10:13 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).
Error: (11/22/2013 05:42:56 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).
Error: (11/22/2013 01:04:31 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 25.0.1.5064, Zeitstempel: 0x5282f204
Name des fehlerhaften Moduls: xul.dll, Version: 25.0.1.5064, Zeitstempel: 0x5282f10e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00118f87
ID des fehlerhaften Prozesses: 0x1154
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (11/21/2013 10:09:02 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 25.0.1.5064 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 5f0
Startzeit: 01cee6f178f48e66
Endzeit: 248
Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe
Berichts-ID: 1fb16da6-52f1-11e3-ba0e-0050babb02c3
Error: (11/21/2013 07:17:59 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).
Error: (11/20/2013 08:52:54 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Program Files\AVAST Software\Avast\Setup\New\instup.exe Files\AVAST Software\Avast\Setup\New\instup.exe" /instop:update_vps_and_program /session_id:12; Beschreibung = avast! antivirus system restore point; Fehler = 0x80070422).
System errors:
=============
Error: (11/20/2013 09:02:22 PM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (11/20/2013 08:59:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "avast! Antivirus" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (11/16/2013 10:30:27 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (11/08/2013 05:49:03 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597 (Definition 1.161.1652.0)
Error: (11/03/2013 01:49:29 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (11/03/2013 01:49:15 AM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (11/01/2013 05:19:34 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597 (Definition 1.161.1215.0)
Error: (10/31/2013 08:46:02 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (10/25/2013 04:27:16 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597 (Definition 1.161.695.0)
Error: (10/18/2013 03:32:56 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Microsoft Office Sessions:
=========================
Error: (11/26/2013 07:29:49 PM) (Source: Application Error)(User: )
Description: firefox.exe25.0.1.50645282f204xul.dll25.0.1.50645282f10ec000000500118f87c0801ceeac769eb14c3C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dllbb0872f2-56c8-11e3-94ee-0050babb02c3
Error: (11/26/2013 05:37:54 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422
Error: (11/25/2013 05:59:08 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422
Error: (11/24/2013 04:07:54 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422
Error: (11/22/2013 06:10:13 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422
Error: (11/22/2013 05:42:56 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422
Error: (11/22/2013 01:04:31 AM) (Source: Application Error)(User: )
Description: firefox.exe25.0.1.50645282f204xul.dll25.0.1.50645282f10ec000000500118f87115401cee715f4f6f7b3C:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dlla8d7bfbb-5309-11e3-bc40-0050babb02c3
Error: (11/21/2013 10:09:02 PM) (Source: Application Hang)(User: )
Description: firefox.exe25.0.1.50645f001cee6f178f48e66248C:\Program Files\Mozilla Firefox\firefox.exe1fb16da6-52f1-11e3-ba0e-0050babb02c3
Error: (11/21/2013 07:17:59 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422
Error: (11/20/2013 08:52:54 PM) (Source: System Restore)(User: )
Description: C:\Program Files\AVAST Software\Avast\Setup\New\instup.exe Files\AVAST Software\Avast\Setup\New\instup.exe" /instop:update_vps_and_program /session_id:12avast! antivirus system restore point0x80070422
==================== Memory info ===========================
Percentage of memory in use: 42%
Total physical RAM: 3581.8 MB
Available physical RAM: 2044.09 MB
Total Pagefile: 7159.84 MB
Available Pagefile: 5497.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1899.38 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:189.82 GB) (Free:138.13 GB) NTFS
Drive e: (CD052A6) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS
Drive f: (Disc) (CDROM) (Total:0.67 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
==================== End Of Log ============================
-------------------- -------------------- Bei GMER ergab sich folgendes Problem: Ich habe GMER unter dem User gespeichert und auch doppelgeklickt/gestartet. Allerdings ging die Passwortabfrage des Admins an. Dann lief GMER problemlos durch. Allerdings wurde das log-File unter dem Admin gespeichert. Auch ein Neustart brachte nichts. Ich habe dann den Admin angemeldet, und das GMER.log auf einen Stick gespeichert. Dann den User angemeldet und dort auf dem Desktop gespeichert. Ich habe da alles mögliche probiert, und benötige konkrete Anweisungen, falls das so falsch ist. Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-26 20:56:46
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Maxtor_6L200R0 rev.BAH41G10 189,92GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Zus\AppData\Local\Temp\uwldypow.sys
---- System - GMER 2.1 ----
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwAddBootEntry [0x8CF26B10]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0x8CF275EE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateEvent [0x8CF335E0]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateEventPair [0x8CF3362C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0x8CF337C6]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateMutant [0x8CF3354E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateSection [0x8CF33670]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateSemaphore [0x8CF33596]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateThread [0x8CF27B24]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateThreadEx [0x8CF27D40]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwCreateTimer [0x8CF33780]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0x8CF283DC]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0x8CF26B76]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwDuplicateObject [0x8CF2BB58]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwLoadDriver [0x8CF2675E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwModifyBootEntry [0x8CF26BDC]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0x8CF2BF4E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0x8CF28E6C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenEvent [0x8CF3360A]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenEventPair [0x8CF3364E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0x8CF337EA]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenMutant [0x8CF33574]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenProcess [0x8CF2B452]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenSection [0x8CF336FE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenSemaphore [0x8CF335BE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenThread [0x8CF2B83A]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwOpenTimer [0x8CF337A4]
SSDT \??\C:\Windows\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0x938D50CC]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwQueryObject [0x8CF28D38]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwQueueApcThreadEx [0x8CF28A46]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0x8CF26C42]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetBootOptions [0x8CF26CA8]
SSDT \??\C:\Windows\system32\drivers\aswSP.sys ZwSetContextThread [0x938D5316]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetSystemInformation [0x8CF267F8]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0x8CF269CE]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwShutdownSystem [0x8CF2695C]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSuspendProcess [0x8CF285A6]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSuspendThread [0x8CF28708]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwSystemDebugControl [0x8CF26A56]
SSDT \??\C:\Windows\system32\drivers\aswSP.sys ZwTerminateProcess [0x938D5194]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwTerminateThread [0x8CF28236]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwVdmControl [0x8CF26D0E]
SSDT \??\C:\Windows\system32\drivers\aswSnx.sys ZwWriteVirtualMemory [0x8CF2764A]
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!ZwRollbackEnlistment + 1409 8283B9A5 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 8285B512 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 1393 82862988 4 Bytes [10, 6B, F2, 8C]
.text ntoskrnl.exe!KeRemoveQueueEx + 141B 82862A10 4 Bytes [EE, 75, F2, 8C]
.text ntoskrnl.exe!KeRemoveQueueEx + 146F 82862A64 8 Bytes [E0, 35, F3, 8C, 2C, 36, F3, ...]
.text ntoskrnl.exe!KeRemoveQueueEx + 147B 82862A70 4 Bytes [C6, 37, F3, 8C]
.text ntoskrnl.exe!KeRemoveQueueEx + 1497 82862A8C 4 Bytes [4E, 35, F3, 8C]
.text ...
PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 108 82A161B1 4 Bytes CALL 8CF2952F \??\C:\Windows\system32\drivers\aswSnx.sys
PAGE ntoskrnl.exe!ZwAlpcSendWaitReceivePort + 122 82A52EED 4 Bytes CALL 8CF29545 \??\C:\Windows\system32\drivers\aswSnx.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Secunia\PSI\psi_tray.exe[360] kernel32.dll!GetBinaryTypeW + 70 75D869E4 1 Byte [62]
.text C:\Windows\system32\csrss.exe[380] kernel32.dll!GetBinaryTypeW + 70 75D869E4 1 Byte [62]
.text C:\Windows\system32\wininit.exe[428] kernel32.dll!GetBinaryTypeW + 70 75D869E4 1 Byte [62]
.text C:\Windows\system32\services.exe[524] kernel32.dll!GetBinaryTypeW + 70 75D869E4 1 Byte [62]
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!GetBinaryTypeW + 70 75D869E4 1 Byte [62]
.text ...
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.sys
AttachedDevice \Driver\tdx \Device\Udp aswTdi.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Falls etwas fehlt, bitte sagen, damit ich das posten kann! Vielen Dank schon mal im Voraus! Gruß! idefix 2013 |
| Themen zu Firefox öffnet unter WIN 7 auch bei mir immer static.icmapp.com |
| 0x8007042, 32 bit, adblock, adobe, antivirus, avast, browser, explorer, gmer.log, homepage, plug-in, pup.optional.crossrider, pup.optional.crossrider.a, pup.optional.hometab.a, pup.optional.plushd.a, secunia psi, security, services.exe, svchost.exe, trojaner, udp, windows |
Baum-Darstellung