MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware

beatric · 21.12.2013, 22:03

So alles gemacht=)

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-12-2013 02
Ran by BEKS at 2013-12-21 21:57:50 Run:3
Running from C:\Users\BEKS\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\Gast\...\Run: [Uvhil] - C:\Users\Gast\AppData\Roaming\Fecyu\byva.exe
C:\Users\Gast\AppData\Roaming\Fecyu
         
*****************

HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\Uvhil => Value not found.
"C:\Users\Gast\AppData\Roaming\Fecyu" => File/Directory not found.

==== End of Fixlog ====

Der neue Scan:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-12-2013 02
Ran by BEKS (administrator) on -BEKS- on 21-12-2013 22:00:05
Running from C:\Users\BEKS\Desktop
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Opera Software) C:\Program Files\Opera\opera.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM 
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM 
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM 
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [Uvhil] - C:\Users\BEKS\AppData\Roaming\Fecyu\byva.exe
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = 
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVSV5&o=15012&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U9&apn_dtid=&apn_uid=BB23562A-B194-4B5E-9562-F71FE3D1B307&apn_sauid=89A19DDF-2957-4EA3-BD6B-576FD972CA2C
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-21 21:52 - 2013-12-21 21:52 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-21 10:47 - 2013-12-21 22:00 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-21 22:00 - 2013-12-21 10:47 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 21:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-21 21:52 - 2013-12-21 21:52 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-21 21:50 - 2007-10-23 17:15 - 01600859 _____ C:\Windows\WindowsUpdate.log
2013-12-21 21:36 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-21 21:36 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-21 20:42 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 20:35 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-21 15:16 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:47 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Fecyu
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-21 20:42

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware

Plagegeister aller Art und deren Bekämpfung: MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware

MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware

Ähnliche Themen: MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware