| |
| |||||||
Log-Analyse und Auswertung: Entfernen von DuckDuckGo Search Engine unter Firefox (OS:Windows 7 (32-Bit))Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
02.01.2014, 13:48
| #5 |
 |  Entfernen von DuckDuckGo Search Engine unter Firefox (OS:Windows 7 (32-Bit)) Hallo Schrauber, erstmal vielen Dank. Ich beobachte schon positive Effekte. Nämlich: Mein I-Net war wirklich langsam, Seiten hatten nicht mehr richtig geladen. Musste immer erst den Browser mehrmals öffnen bis es dann irgendwann halbwegs funktionierte, was total nervig war. Das ist jetzt schon alles behoben  Leider hat mich die Seite gekickt und ich konnte die Logs, die schon in die Antwort eingefügt waren, nicht mehr posten. Die ESET-Log ist auch schon vom Rechner entfernt, da ich nach dem Scan und dem Einfügen hier das Programm mit allem Drum und Dran deinstalliert und den Papierkorb geleert habe. Es hatte aber keine Bedrohungen gefunden. Die beiden anderen Log-Files sind noch da. 1. Security-Check: Code:
ATTFilter Results of screen317's Security Check version 0.99.77 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Anti-Virus Advanced SystemCare with Antivirus Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Java 7 Update 45 Adobe Flash Player 9 Flash Player out of Date! Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.9.900.170 Adobe Reader XI Mozilla Firefox (26.0) Google Chrome 31.0.1650.57 Google Chrome 31.0.1650.63 ````````Process Check: objlist.exe by Laurent```````` IObit Advanced SystemCare with Antivirus 2013 ascsvc.exe IObit Advanced SystemCare with Antivirus 2013 ascavsvc.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-12-2013
Ran by De La Rose (administrator) on SUCHTKASTEN on 02-01-2014 12:37:02
Running from C:\Users\De La Rose\Desktop\PC-Analyseprogs
Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(IObit) C:\Program Files\IObit\Advanced SystemCare with Antivirus 2013\ASCSvc.exe
(IOBit) C:\Program Files\IObit\Advanced SystemCare with Antivirus 2013\ASCAvSvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files\D-Link\DWA-140 revB\ANIWConnService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(CANON INC.) C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe
(D-Link Corp.) C:\Program Files\D-Link\DWA-140 revB\AirNCFG.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Akamai Technologies, Inc.) C:\Users\De La Rose\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Akamai Technologies, Inc.) C:\Users\De La Rose\AppData\Local\Akamai\netsession_win.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HDAudDeck] - C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1681408 2009-09-21] (VIA)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-02] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [CanonSolutionMenuEx] - C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [1316248 2010-12-02] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2569616 2010-07-26] (CANON INC.)
HKLM\...\Run: [Philips Device Listener] - C:\Program Files\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe [380416 2011-03-03] ()
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [D-Link D-Link Wireless N DWA-140] - C:\Program Files\D-Link\DWA-140 revB\AirNCFG.exe [1024000 2010-06-30] (D-Link Corp.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe [2975640 2010-11-05] ()
HKCU\...\Run: [ccleaner] - C:\Program Files\CCleaner\CCleaner.exe [3591960 2013-05-24] (Piriform Ltd)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\De La Rose\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [Advanced SystemCare 5] - C:\Program Files\IObit\Advanced SystemCare with Antivirus 2013\ASCTray.exe [299392 2012-07-26] (IObit)
MountPoints2: {165729f7-38ff-11df-9392-00252204b807} - G:\autorun.exe
MountPoints2: {907382f9-3088-11e1-8920-00252204b807} - F:\setup.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://duckduckgo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8205ADD600CDCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - (No Name) - {1ce76c93-a797-4ca2-ab3c-f4a6cfba3440} - No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {6579BD32-B656-4E80-BAF7-6DCB4B33D008} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hsimp=yhs-affiliate_a&hspart=greentree&type=380920&p={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{FE8C4194-3102-4A3C-8FA3-F6EFA6D879F1}: [NameServer]192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\De La Rose\AppData\Roaming\Mozilla\Firefox\Profiles\k2zwqodg.default-1379424446130
FF Homepage: about:home
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @gametap.com/npdd,version=1.0 - B:\Downloader\Metaboli\npdd.dll (Metaboli)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\De La Rose\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\De La Rose\AppData\Roaming\Mozilla\Firefox\Profiles\k2zwqodg.default-1379424446130\searchplugins\duckduckgo.xml
FF SearchPlugin: C:\Users\De La Rose\AppData\Roaming\Mozilla\Firefox\Profiles\k2zwqodg.default-1379424446130\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\De La Rose\AppData\Roaming\Mozilla\Firefox\Profiles\k2zwqodg.default-1379424446130\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\De La Rose\AppData\Roaming\Mozilla\Firefox\Profiles\k2zwqodg.default-1379424446130\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\De La Rose\AppData\Roaming\Mozilla\Firefox\Profiles\k2zwqodg.default-1379424446130\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\De La Rose\AppData\Roaming\Mozilla\Firefox\Profiles\k2zwqodg.default-1379424446130\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com
Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Downloader Detector) - B:\Downloader\Metaboli\npdd.dll (Metaboli)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Facebook Plugin) - C:\Users\De La Rose\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll No File
CHR Extension: (Google Docs) - C:\Users\De La Rose\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\De La Rose\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\De La Rose\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\De La Rose\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Google Wallet) - C:\Users\De La Rose\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\De La Rose\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\urladvisor.crx
CHR HKLM\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\content_blocker_chrome.crx
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx
CHR HKLM\...\Chrome\Extension: [ofahndfepeaeelmhdkjiihmofnokhmik] - C:\Users\DELARO~1\AppData\Local\Temp\tbch.crx
========================== Services (Whitelisted) =================
R2 AdvancedSystemCareService5; C:\Program Files\IObit\Advanced SystemCare with Antivirus 2013\ascsvc.exe [514432 2012-07-26] (IObit)
R2 Akamai; c:\program files\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 ASCAntivirusSrv; C:\Program Files\IObit\Advanced SystemCare with Antivirus 2013\ascavsvc.exe [906112 2012-08-23] (IOBit)
S2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe [214512 2013-11-26] (Kaspersky Lab ZAO)
R2 D-Link Wireless N DWA-140_WPS; C:\Program Files\D-Link\DWA-140 revB\ANIWConnService.exe [53248 2010-06-03] ()
==================== Drivers (Whitelisted) ====================
R1 anodlwf; C:\Windows\System32\DRIVERS\anodlwf.sys [12800 2009-03-06] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2010-04-09] ()
S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [251728 2010-12-08] (AVG Technologies CZ, s.r.o.)
R2 bdfsfltr; C:\Windows\System32\DRIVERS\bdfsfltr.sys [353096 2012-03-15] (BitDefender)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2013-11-26] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [94304 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [574560 2014-01-01] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-11-26] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25696 2013-11-26] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-11-26] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [144992 2014-01-01] (Kaspersky Lab ZAO)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2010-04-09] ()
R3 netr28u; C:\Windows\System32\DRIVERS\Dnetr28u.sys [855392 2010-05-05] (Ralink Technology Corp.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [443448 2011-10-23] (Duplex Secure Ltd.)
S3 Trufos; C:\Windows\System32\DRIVERS\TRUFOS.sys [340624 2011-11-21] (BitDefender S.R.L.)
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1086976 2009-09-17] (VIA Technologies, Inc.)
S2 adfs; No ImagePath
S3 cpuz135; \??\C:\Users\DELARO~1\AppData\Local\Temp\cpuz135\cpuz135_x32.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-02 12:32 - 2014-01-02 12:32 - 00000224 _____ C:\Windows\setupact.log
2014-01-02 12:32 - 2014-01-02 12:32 - 00000000 _____ C:\Windows\setuperr.log
2014-01-02 10:55 - 2014-01-02 10:55 - 02347384 _____ (ESET) C:\Users\De La Rose\Downloads\esetsmartinstaller_enu.exe
2014-01-02 10:55 - 2014-01-02 10:55 - 00891200 _____ C:\Users\De La Rose\Desktop\SecurityCheck.exe
2014-01-02 00:50 - 2014-01-02 12:37 - 00000000 ____D C:\Users\De La Rose\Desktop\PC-Analyseprogs
2014-01-02 00:49 - 2014-01-02 00:50 - 00000000 ____D C:\Users\De La Rose\Desktop\Log-Files
2014-01-01 16:00 - 2014-01-02 12:25 - 00103465 ____N C:\Windows\WindowsUpdate.log
2014-01-01 16:00 - 2014-01-01 16:00 - 00000000 ____D C:\Windows\ERUNT
2014-01-01 15:53 - 2014-01-01 15:56 - 00000000 ____D C:\AdwCleaner
2014-01-01 15:36 - 2014-01-01 15:36 - 00000000 ____D C:\Users\De La Rose\AppData\Roaming\Malwarebytes
2014-01-01 15:36 - 2014-01-01 15:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 15:36 - 2014-01-01 15:36 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-01 15:36 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-01 13:36 - 2014-01-01 13:36 - 00001059 _____ C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-01-01 13:35 - 2014-01-02 10:51 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-01 13:35 - 2014-01-01 14:13 - 00574560 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-01 13:35 - 2014-01-01 13:35 - 00000000 ____D C:\Windows\ELAMBKUP
2014-01-01 13:35 - 2014-01-01 13:35 - 00000000 ____D C:\Program Files\Kaspersky Lab
2014-01-01 13:35 - 2013-06-08 20:18 - 00094304 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-01-01 13:33 - 2014-01-01 13:33 - 00000000 ____D C:\Program Files\Microsoft.NET
2014-01-01 13:25 - 2014-01-01 13:27 - 221425472 _____ (Kaspersky Lab) C:\Users\De La Rose\Desktop\kav14.0.0.4651en_5447_trial.exe
2014-01-01 12:51 - 2014-01-01 12:51 - 00000000 ____D C:\FRST
2014-01-01 12:46 - 2014-01-01 12:46 - 00000020 _____ C:\Users\De La Rose\defogger_reenable
2013-12-12 07:56 - 2013-12-12 07:56 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-12 00:46 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 00:46 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-12 00:46 - 2013-11-26 10:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-12 00:46 - 2013-11-26 09:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-12 00:46 - 2013-11-26 09:52 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-12 00:46 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 00:46 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-12 00:46 - 2013-11-26 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-12 00:46 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-12 00:46 - 2013-11-26 09:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-12 00:46 - 2013-11-26 09:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-12 00:46 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-12 00:46 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 00:46 - 2013-11-26 09:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 00:46 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-12 00:46 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 00:46 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-12 00:46 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 00:46 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 07:11 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 07:11 - 2013-10-30 02:27 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 07:11 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 07:11 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 07:11 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 07:11 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 07:11 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 07:11 - 2013-10-04 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 07:11 - 2013-10-04 02:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-08 17:18 - 2013-12-08 17:18 - 00001240 _____ C:\Users\De La Rose\Desktop\Amazon Cloud Player.lnk
2013-12-08 17:18 - 2013-12-08 17:18 - 00000000 ____D C:\Users\De La Rose\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-08 17:18 - 2013-12-08 17:18 - 00000000 ____D C:\Users\De La Rose\AppData\Local\Amazon Cloud Player
2013-12-08 17:17 - 2013-12-08 17:17 - 36117312 _____ (Amazon) C:\Users\De La Rose\Downloads\AmazonCloudPlayerInstaller_381.exe
==================== One Month Modified Files and Folders =======
2014-01-02 12:37 - 2014-01-02 00:50 - 00000000 ____D C:\Users\De La Rose\Desktop\PC-Analyseprogs
2014-01-02 12:32 - 2014-01-02 12:32 - 00000224 _____ C:\Windows\setupact.log
2014-01-02 12:32 - 2014-01-02 12:32 - 00000000 _____ C:\Windows\setuperr.log
2014-01-02 12:25 - 2014-01-01 16:00 - 00103465 ____N C:\Windows\WindowsUpdate.log
2014-01-02 12:21 - 2012-07-16 09:39 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-02 11:50 - 2012-03-29 14:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-02 11:22 - 2010-06-28 12:33 - 00000000 ____D C:\Users\De La Rose\AppData\Local\PMB Files
2014-01-02 10:55 - 2014-01-02 10:55 - 02347384 _____ (ESET) C:\Users\De La Rose\Downloads\esetsmartinstaller_enu.exe
2014-01-02 10:55 - 2014-01-02 10:55 - 00891200 _____ C:\Users\De La Rose\Desktop\SecurityCheck.exe
2014-01-02 10:52 - 2009-07-14 05:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-02 10:52 - 2009-07-14 05:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-02 10:51 - 2014-01-01 13:35 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-02 10:51 - 2012-07-16 09:39 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-02 10:48 - 2010-08-27 09:00 - 00000000 ____D C:\Program Files\Common Files\Akamai
2014-01-02 10:47 - 2011-07-10 18:06 - 00000314 ___SH C:\Windows\Tasks\AUVU.job
2014-01-02 10:47 - 2010-12-09 10:09 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2014-01-02 10:47 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-02 01:41 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2014-01-02 00:52 - 2010-10-12 13:40 - 00000000 ____D C:\Users\De La Rose\AppData\Roaming\Winamp
2014-01-02 00:50 - 2014-01-02 00:49 - 00000000 ____D C:\Users\De La Rose\Desktop\Log-Files
2014-01-01 16:00 - 2014-01-01 16:00 - 00000000 ____D C:\Windows\ERUNT
2014-01-01 15:56 - 2014-01-01 15:53 - 00000000 ____D C:\AdwCleaner
2014-01-01 15:36 - 2014-01-01 15:36 - 00000000 ____D C:\Users\De La Rose\AppData\Roaming\Malwarebytes
2014-01-01 15:36 - 2014-01-01 15:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 15:36 - 2014-01-01 15:36 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-01 14:13 - 2014-01-01 13:35 - 00574560 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-01 14:13 - 2013-06-06 17:38 - 00144992 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-01 13:40 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2014-01-01 13:36 - 2014-01-01 13:36 - 00001059 _____ C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-01-01 13:35 - 2014-01-01 13:35 - 00000000 ____D C:\Windows\ELAMBKUP
2014-01-01 13:35 - 2014-01-01 13:35 - 00000000 ____D C:\Program Files\Kaspersky Lab
2014-01-01 13:34 - 2010-03-26 17:24 - 01540144 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 13:33 - 2014-01-01 13:33 - 00000000 ____D C:\Program Files\Microsoft.NET
2014-01-01 13:27 - 2014-01-01 13:25 - 221425472 _____ (Kaspersky Lab) C:\Users\De La Rose\Desktop\kav14.0.0.4651en_5447_trial.exe
2014-01-01 12:52 - 2013-04-01 06:01 - 00000000 ____D C:\Users\postgres
2014-01-01 12:51 - 2014-01-01 12:51 - 00000000 ____D C:\FRST
2014-01-01 12:46 - 2014-01-01 12:46 - 00000020 _____ C:\Users\De La Rose\defogger_reenable
2014-01-01 12:46 - 2010-03-26 17:00 - 00000000 ____D C:\Users\De La Rose
2013-12-26 22:44 - 2013-11-03 08:54 - 00000000 ____D C:\ProgramData\HappyCloud
2013-12-26 22:41 - 2011-04-08 21:11 - 00000000 ____D C:\Users\De La Rose\AppData\Local\Electronic Arts
2013-12-26 22:41 - 2010-03-29 19:52 - 00000000 ____D C:\Program Files\Electronic Arts
2013-12-22 20:05 - 2011-09-14 18:51 - 00000000 ____D C:\Users\De La Rose\AppData\Roaming\Canon
2013-12-18 09:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2013-12-17 15:41 - 2012-10-17 20:28 - 00000000 ____D C:\ProgramData\iobit
2013-12-12 11:31 - 2012-05-03 05:40 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-12 11:28 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-12-12 07:56 - 2013-12-12 07:56 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-12 06:28 - 2009-07-14 05:33 - 02215744 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-12 06:26 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-12-12 00:46 - 2013-07-19 23:42 - 00000000 ____D C:\Windows\system32\MRT
2013-12-12 00:45 - 2010-03-26 18:34 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-11 19:50 - 2012-03-29 14:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-11 19:50 - 2011-05-16 18:27 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 00:02 - 2010-03-27 11:54 - 00000000 ____D C:\Users\De La Rose\AppData\Local\PokerStars.EU
2013-12-08 17:18 - 2013-12-08 17:18 - 00001240 _____ C:\Users\De La Rose\Desktop\Amazon Cloud Player.lnk
2013-12-08 17:18 - 2013-12-08 17:18 - 00000000 ____D C:\Users\De La Rose\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-08 17:18 - 2013-12-08 17:18 - 00000000 ____D C:\Users\De La Rose\AppData\Local\Amazon Cloud Player
2013-12-08 17:17 - 2013-12-08 17:17 - 36117312 _____ (Amazon) C:\Users\De La Rose\Downloads\AmazonCloudPlayerInstaller_381.exe
2013-12-05 21:27 - 2013-01-02 09:47 - 00000000 ____D C:\Program Files\PokerStars.EU
2013-12-05 20:27 - 2013-09-24 09:13 - 00002121 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-03 09:58 - 2009-07-14 05:53 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
Some content of TEMP:
====================
C:\Users\De La Rose\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-30 00:58
==================== End Of Log ============================
--- --- --- --- --- --- DuckDuckGo ist immer noch da. Krass, wenn man bedenkt, dass mir die Suchmaschine in einem Artikel von Spiegel-Online als sichere,anonyme Suchmaschine empfohlen wurde. Hätte den Mist sonst nie installiert.  Hey, auch sonst leider wieder alles beim Alten. I-Net extrem langsam, Seiten laden nicht usw... Hatte vergessen, die Firewall und Kaspersky nach ESET wieder zu aktivieren, bevor ich ins Internet gegangen bin und sofort waren die alten Probleme auch wieder da, nachdem seit gestern abend alles wunderbar funktionierte. Lädt sich evtl. irgendetwas sofort runter, wenn ich die Firewall deaktiviere? Ist sowas möglich? Geändert von kluksch (02.01.2014 um 13:03 Uhr) |
| Themen zu Entfernen von DuckDuckGo Search Engine unter Firefox (OS:Windows 7 (32-Bit)) |
| akamai, antivirus, branding, browser, canon, computer, downloader, duckduckgo, entfernen, flash player, hijack.zones, homepage, plug-in, problem, prozessor, registry, required, richtlinie, schach, software, suchmaschine, svchost.exe, trojan.downloader, trojan.fakealert, trojan.fakealert.sa, vista, windows, windows xp |
Baum-Darstellung