|
Plagegeister aller Art und deren Bekämpfung: search.conduit - Werbebanner und Pop-UpsWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
11.01.2014, 22:54 | #1 |
| search.conduit - Werbebanner und Pop-Ups Hallo, ich habe das gleiche Problem, welches vor kurzem bereits hier: http://www.trojaner-board.de/147076-...-trojaner.html behoben wurde. Als Startseite im Firefox ist search.conduit... hinterlegt und nicht aenderbar. Aussedem kommen auch bei mir ungewollt Werbebanner auf der Google Startseite sowie diverse Pop-Up-Fenster beim Serven. Ich habe den ersten, dort vorgeschlagenen Schritt bereits unternommen und FRST heruntergeladen und den Rechner damit gescannt. Das Ergebnis der beiden Log-Files folgt nun: Vorab schon mal besten Dank! Gruss Petterson FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-01-2014 03 Ran by Margret (administrator) on MARGRET-PC on 11-01-2014 22:45:20 Running from C:\Users\Margret\Desktop Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (Lenovo.) C:\Windows\System32\ibmpmsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareService.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (Lenovo Group Limited) C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe () C:\ProgramData\dlprotect.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareTray.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-20] (APN) HKLM\...\Run: [TPFNF7] - C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe [62240 2009-08-04] (Lenovo Group Limited) HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe [63784 2013-03-18] (Lenovo) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM\...\Run: [Download Protect] - C:\ProgramData\dlprotect.exe [12800 2013-12-14] () HKLM\...\Run: [] - [x] HKLM\...\Run: [AdAwareTray] - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareTray.exe [3540312 2013-12-11] () HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) Lsa: [Notification Packages] scecli ACGina ==================== Internet (Whitelisted) ==================== SearchScopes: HKLM - DefaultScope {1534CFE4-50E4-4504-B3CF-5AFEBA99342D} URL = SearchScopes: HKCU - DefaultScope {1534CFE4-50E4-4504-B3CF-5AFEBA99342D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = SearchScopes: HKCU - {1534CFE4-50E4-4504-B3CF-5AFEBA99342D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default FF user.js: detected! => C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\user.js FF DefaultSearchEngine: RadioTotal4 Customized Web Search FF SelectedSearchEngine: RadioTotal4 Customized Web Search FF Homepage: hxxp://search.conduit.com/?ctid=CT3317893&octid=CT3317893&SearchSource=61&CUI=UN15380372102735323&UM=2&UP=SP2C187999-612A-41B0-A150-E5F4E596909B FF Keyword.URL: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317893&SearchSource=2&CUI=UN15380372102735323&UM=2&q= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\searchplugins\conduit-search.xml FF SearchPlugin: C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\searchplugins\conduit.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: vis - C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2013-12-14] FF Extension: RadioTotal4 - C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\Extensions\{61f0d019-b016-4d56-9dae-7b7706cd6755} [2013-12-14] FF HKLM\...\Firefox\Extensions: [ext@VideoPlayerV3beta690.net] - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta690\ff FF Extension: Video Player - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta690\ff [2014-01-09] ========================== Services (Whitelisted) ================= R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [133416 2013-03-18] (Lenovo) R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [272680 2013-03-18] (Lenovo) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-28] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG) R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.) R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareService.exe [494136 2013-12-11] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-28] (Avira Operations GmbH & Co. KG) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-16] (Avira GmbH) R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [340624 2013-07-17] (BitDefender S.R.L.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-11 22:45 - 2014-01-11 22:45 - 00009170 _____ C:\Users\Margret\Desktop\FRST.txt 2014-01-11 22:45 - 2014-01-11 22:45 - 00000000 ____D C:\FRST 2014-01-11 22:44 - 2014-01-11 22:44 - 01220096 _____ (Farbar) C:\Users\Margret\Desktop\FRST.exe 2014-01-11 18:57 - 2014-01-11 18:57 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Margret\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-11 18:56 - 2014-01-11 18:56 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2014-01-11 18:56 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-01-11 18:46 - 2014-01-11 18:46 - 00001608 _____ C:\Users\Margret\Desktop\Ad-Aware_Report_Full_Manual_2014-01-11T18-45-02.721864.xml 2014-01-11 18:11 - 2014-01-11 18:11 - 00000000 ____D C:\Users\Margret\AppData\Roaming\LavasoftStatistics 2014-01-11 17:58 - 2014-01-11 20:57 - 00002305 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Lavasoft 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Program Files\Lavasoft 2014-01-11 17:55 - 2014-01-11 17:55 - 00000000 ____D C:\Program Files\Common Files\Lavasoft 2014-01-11 17:54 - 2014-01-11 17:54 - 00000000 ____D C:\ProgramData\Lavasoft 2014-01-11 17:53 - 2014-01-11 17:53 - 01725064 _____ C:\Users\Margret\Downloads\Adaware_Installer_11.1.exe 2014-01-09 21:22 - 2014-01-09 21:22 - 00000000 ____D C:\Program Files\VideoPlayerV3 2013-12-24 15:38 - 2013-12-24 15:38 - 00000000 ____D C:\Windows\system32\SearchProtect 2013-12-23 22:51 - 2013-12-23 22:51 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-12-14 09:49 - 2014-01-11 20:54 - 00000000 ____D C:\Users\Margret\AppData\Local\SwvUpdater 2013-12-14 09:49 - 2014-01-11 20:54 - 00000000 ____D C:\ProgramData\Conduit 2013-12-14 09:49 - 2014-01-11 13:26 - 00000000 ____D C:\Users\Margret\AppData\Local\Conduit 2013-12-14 09:49 - 2013-12-14 09:49 - 00012800 _____ C:\ProgramData\dlprotect.exe 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Windows Net Data 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\Google 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Program Files\Conduit 2013-12-14 09:48 - 2013-12-14 09:48 - 00566423 _____ C:\Users\Margret\Downloads\installminecraft.dmg 2013-12-14 09:48 - 2013-12-14 09:48 - 00000159 _____ C:\Users\Margret\Desktop\100 Euro Guthaben.url 2013-12-14 09:48 - 2013-12-14 09:48 - 00000000 ____D C:\Users\Margret\AppData\Local\DownloadGuide 2013-12-12 22:25 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-12-12 22:25 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-12-12 22:25 - 2013-11-26 10:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-12-12 22:25 - 2013-11-26 09:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-12-12 22:25 - 2013-11-26 09:52 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-12-12 22:25 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-12-12 22:25 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-12-12 22:25 - 2013-11-26 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-12-12 22:25 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-12-12 22:25 - 2013-11-26 09:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-12-12 22:25 - 2013-11-26 09:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-12-12 22:25 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-12-12 22:25 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-12-12 22:25 - 2013-11-26 09:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-12-12 22:25 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-12-12 22:25 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-12-12 22:25 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-12-12 22:25 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-12-12 22:25 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-12-12 15:04 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-12-12 15:04 - 2013-10-30 02:27 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-12-12 15:04 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2013-12-12 15:04 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2013-12-12 15:04 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2013-12-12 15:04 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2013-12-12 15:04 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2013-12-12 15:04 - 2013-10-04 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2013-12-12 15:04 - 2013-10-04 02:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys ==================== One Month Modified Files and Folders ======= 2014-01-11 22:45 - 2014-01-11 22:45 - 00009170 _____ C:\Users\Margret\Desktop\FRST.txt 2014-01-11 22:45 - 2014-01-11 22:45 - 00000000 ____D C:\FRST 2014-01-11 22:44 - 2014-01-11 22:44 - 01220096 _____ (Farbar) C:\Users\Margret\Desktop\FRST.exe 2014-01-11 22:35 - 2013-07-16 14:44 - 01895633 _____ C:\Windows\WindowsUpdate.log 2014-01-11 21:07 - 2013-07-18 12:18 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Skype 2014-01-11 21:04 - 2009-07-14 05:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-11 21:04 - 2009-07-14 05:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-11 21:01 - 2010-11-20 22:01 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-11 20:57 - 2014-01-11 17:58 - 00002305 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-01-11 20:56 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-11 20:55 - 2010-11-20 22:48 - 00025396 _____ C:\Windows\PFRO.log 2014-01-11 20:55 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\addins 2014-01-11 20:55 - 2009-07-14 05:39 - 00038834 _____ C:\Windows\setupact.log 2014-01-11 20:54 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\SwvUpdater 2014-01-11 20:54 - 2013-12-14 09:49 - 00000000 ____D C:\ProgramData\Conduit 2014-01-11 18:57 - 2014-01-11 18:57 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Margret\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-11 18:56 - 2014-01-11 18:56 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2014-01-11 18:46 - 2014-01-11 18:46 - 00001608 _____ C:\Users\Margret\Desktop\Ad-Aware_Report_Full_Manual_2014-01-11T18-45-02.721864.xml 2014-01-11 18:11 - 2014-01-11 18:11 - 00000000 ____D C:\Users\Margret\AppData\Roaming\LavasoftStatistics 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Lavasoft 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Program Files\Lavasoft 2014-01-11 17:55 - 2014-01-11 17:55 - 00000000 ____D C:\Program Files\Common Files\Lavasoft 2014-01-11 17:54 - 2014-01-11 17:54 - 00000000 ____D C:\ProgramData\Lavasoft 2014-01-11 17:53 - 2014-01-11 17:53 - 01725064 _____ C:\Users\Margret\Downloads\Adaware_Installer_11.1.exe 2014-01-11 13:26 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\Conduit 2014-01-09 21:23 - 2013-07-26 16:53 - 00000000 ____D C:\Users\Margret\Documents\Freundeskreis Gronau-Pfaffenheim 2014-01-09 21:22 - 2014-01-09 21:22 - 00000000 ____D C:\Program Files\VideoPlayerV3 2013-12-29 10:33 - 2013-07-16 15:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-12-24 15:38 - 2013-12-24 15:38 - 00000000 ____D C:\Windows\system32\SearchProtect 2013-12-23 22:51 - 2013-12-23 22:51 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-12-18 22:47 - 2013-07-18 11:56 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-12-18 22:47 - 2013-07-16 14:56 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-12-18 22:47 - 2013-07-16 14:56 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-12-17 20:24 - 2013-07-18 12:18 - 00000000 ___RD C:\Program Files\Skype 2013-12-17 20:24 - 2013-07-18 12:18 - 00000000 ____D C:\ProgramData\Skype 2013-12-16 19:22 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\system32\FxsTmp 2013-12-14 09:49 - 2013-12-14 09:49 - 00012800 _____ C:\ProgramData\dlprotect.exe 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Windows Net Data 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\Google 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Program Files\Conduit 2013-12-14 09:48 - 2013-12-14 09:48 - 00566423 _____ C:\Users\Margret\Downloads\installminecraft.dmg 2013-12-14 09:48 - 2013-12-14 09:48 - 00000159 _____ C:\Users\Margret\Desktop\100 Euro Guthaben.url 2013-12-14 09:48 - 2013-12-14 09:48 - 00000000 ____D C:\Users\Margret\AppData\Local\DownloadGuide 2013-12-14 09:30 - 2009-07-14 05:33 - 00406584 _____ C:\Windows\system32\FNTCACHE.DAT 2013-12-14 09:28 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE 2013-12-12 22:25 - 2013-08-18 21:27 - 00000000 ____D C:\Windows\system32\MRT 2013-12-12 22:24 - 2013-07-18 12:36 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe Files to move or delete: ==================== C:\ProgramData\dlprotect.exe Some content of TEMP: ==================== C:\Users\Margret\AppData\Local\Temp\avgnt.exe C:\Users\Margret\AppData\Local\Temp\ose00000.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-11 09:03 ==================== End Of Log ============================ Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-01-2014 03 Ran by Margret at 2014-01-11 22:45:49 Running from C:\Users\Margret\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996} AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED} ==================== Installed Programs ====================== Ad-Aware Antivirus (Version: 11.1.5152.0 - Lavasoft) AdAwareInstaller (Version: 11.1.5152.0 - Lavasoft) Hidden AdAwareUpdater (Version: 11.1.5152.0 - Lavasoft) Hidden Adobe Flash Player 11 Plugin (Version: 11.8.800.94 - Adobe Systems Incorporated) Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03 - Adobe Systems Incorporated) Amazonia (Version: - cerasus.media GmbH) AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden Avira Free Antivirus (Version: 14.0.2.286 - Avira) Avira SearchFree Toolbar (Version: 12.10.0.2948 - APN, LLC) Canon Inkjet Printer Driver Add-On Module (Version: - ) dm-Fotowelt (Version: - ) Intel(R) Management Engine Interface (Version: - Intel Corporation) Lenovo Power Management Driver (Version: 1.67.00.02 - ) Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation) Microsoft Office Access MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Home and Student 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Single Image 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 26.0 (x86 de) (Version: 26.0 - Mozilla) Mozilla Maintenance Service (Version: 26.0 - Mozilla) Mozilla Thunderbird 24.2.0 (x86 de) (Version: 24.2.0 - Mozilla) Präsentationsdirektor (Version: 4.32 - ) Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.) SPG-Verein 3.1 (Version: 3.1.11 - Software Peter Große) Svens Yatzy 3 (Version: 3.0.1 - Sven Herrmann) ThinkVantage Access Connections (Version: 6.01 - Lenovo) Um die Welt in 80 Tagen 1.0 (Version: - ) Video Player (Version: 1.1 - Video Player) VIS (Version: - ) VLC media player 2.0.5 (Version: 2.0.5 - VideoLAN) ==================== Restore Points ========================= 10-11-2013 18:49:02 Geplanter Prüfpunkt 13-11-2013 11:32:40 Windows Update 13-11-2013 20:54:49 Windows Update 21-11-2013 12:16:30 Windows Update 28-11-2013 21:16:14 Geplanter Prüfpunkt 08-12-2013 20:12:45 Geplanter Prüfpunkt 12-12-2013 21:23:35 Windows Update 11-01-2014 16:54:25 AA11 ==================== Hosts content: ========================== 2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {B89DC353-2E4F-4969-B1F0-5159CB7E7AD5} - \BackgroundContainer Startup Task No Task File ==================== Loaded Modules (whitelisted) ============= 2013-12-11 18:26 - 2013-12-11 18:26 - 02041200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareShellExtension.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 02038088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\RCF.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00131920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\pugixml.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00107392 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\boost_filesystem-vc100-mt-1_53.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00021880 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\boost_system-vc100-mt-1_53.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00048000 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\boost_date_time-vc100-mt-1_53.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00086904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\boost_thread-vc100-mt-1_53.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00405368 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\boost_locale-vc100-mt-1_53.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00307552 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\HtmlFramework.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00122704 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\libssh2.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00148808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\zlib.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00232272 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\Logger.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00055128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\DllStorage.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00781168 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareTrayDefaultSkin.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00121176 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\Localization.dll 2013-12-11 18:26 - 2013-12-11 18:26 - 00541008 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\SQLite.dll 2013-12-23 22:51 - 2013-12-23 22:51 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll 2013-07-18 13:24 - 2013-07-18 13:24 - 16166280 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= Name: Serieller PCI-Anschluss Description: Serieller PCI-Anschluss Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Fingerprint Sensor Description: Fingerprint Sensor Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (01/11/2014 08:57:43 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/11/2014 06:50:14 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/11/2014 01:31:55 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/11/2014 00:49:58 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/10/2014 07:21:03 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/09/2014 05:12:08 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/08/2014 05:28:44 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/07/2014 05:08:45 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/06/2014 04:12:14 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/05/2014 03:15:22 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (01/11/2014 10:35:43 PM) (Source: ACPI) (User: ) Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft. Error: (01/11/2014 06:55:16 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/11/2014 06:50:06 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/11/2014 01:36:06 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/11/2014 01:30:56 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/07/2014 05:07:46 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/06/2014 04:11:15 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/05/2014 03:21:17 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/05/2014 03:16:07 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (01/01/2014 07:10:43 PM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.27 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Microsoft Office Sessions: ========================= Error: (01/11/2014 08:57:43 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/11/2014 06:50:14 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/11/2014 01:31:55 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/11/2014 00:49:58 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/10/2014 07:21:03 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/09/2014 05:12:08 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/08/2014 05:28:44 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/07/2014 05:08:45 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/06/2014 04:12:14 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/05/2014 03:15:22 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 ==================== Memory info =========================== Percentage of memory in use: 42% Total physical RAM: 3032.03 MB Available physical RAM: 1752.94 MB Total Pagefile: 6062.34 MB Available Pagefile: 4499.21 MB Total Virtual: 2047.88 MB Available Virtual: 1906.17 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:148.95 GB) (Free:118.56 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 3456C271) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
12.01.2014, 07:14 | #2 |
/// the machine /// TB-Ausbilder | search.conduit - Werbebanner und Pop-Ups hi,
__________________Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
12.01.2014, 10:47 | #3 |
| search.conduit - Werbebanner und Pop-Ups Hallo,
__________________danke fuer die schnelle Reaktion. Mit Malwarebytes hatte ich gestern bereits gescannt und 46 Funde entfernt. Daher hier beide Log Files (gestern und heute). Malwarebytes gestern: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.11.04 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 11.0.9600.16476 Margret :: MARGRET-PC [Administrator] 11.01.2014 18:57:38 MBAM-log-2014-01-11 (19-46-45).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 277353 Laufzeit: 43 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 9 HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Keine Aktion durchgeführt. HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Optional.SoftwareUpdater) -> Keine Aktion durchgeführt. HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Optional.SoftwareUpdater) -> Keine Aktion durchgeführt. HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Optional.SoftwareUpdater) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Optional.SoftwareUpdater) -> Keine Aktion durchgeführt. HKCR\Updater.AmiUpd.1 (PUP.Optional.SoftwareUpdater) -> Keine Aktion durchgeführt. HKCR\Updater.AmiUpd (PUP.Optional.SoftwareUpdater) -> Keine Aktion durchgeführt. HKCR\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1} (PUP.Optional.Conduit) -> Keine Aktion durchgeführt. HKCU\Software\Conduit\FF (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 1 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Conduit.A) -> Bösartig: (hxxp://search.conduit.com/?ctid=CT3317893&octid=CT3317893&SearchSource=61&CUI=UN27152860991287239&UM=2&UP=SP2C187999-612A-41B0-A150-E5F4E596909B&SSPV=) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 6 C:\Users\Margret\AppData\Local\Temp\ct3317893 (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\xpi (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\xpi\defaults (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\ProgramData\Conduit\IE (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Program Files\WebexpEnhancedV1 (PUP.Optional.Webexp) -> Keine Aktion durchgeführt. Infizierte Dateien: 39 C:\Users\Margret\AppData\Local\SwvUpdater\Updater.exe (PUP.Optional.SoftwareUpdater) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\DownloadGuide\Offers\mconduitinstaller.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\DownloadGuide\Offers\wajam_download.exe (PUP.Optional.Wajam) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OJ4T33M\SPSetup[1].exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4OJ4T33M\wajam_install[1].exe (PUP.Optional.Wajam) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU8OV0JZ\radiototal4[1].exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FU8OV0JZ\RadioTotal4[2].exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K9WERINI\checktbexist[1].exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNZ49MEU\statisticsstub[1].exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNZ49MEU\conduitinstaller[1].exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\nscF7CC.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\nskF828.exe (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\nsm2657.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\nsrD51C.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\SPStub.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\tbRadi.dll (PUP.Optional.Conduit) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\nsx3845.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\AU\SPSetup.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\ctbe.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\ffLogic.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\ieLogic.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\spff.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\statisticsStub.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\stub.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\Downloads\Minencraft.exe (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt. C:\Program Files\Conduit\Community Alerts\Alert.dll (PUP.Optional.Conduit) -> Keine Aktion durchgeführt. C:\Windows\Temp\nseEF2.exe (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Windows\Temp\nsz122E.exe (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Windows\Temp\nsz149C.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Windows\Temp\nsz65AB.exe (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> Keine Aktion durchgeführt. C:\Windows\System32\Tasks\BackgroundContainer Startup Task (PUP.Optional.Conduit) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\chromeid.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\conduit.xml (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\CT3317893.xpi (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\setup.ini.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\version.txt (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\xpi\install.rdf (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. C:\Users\Margret\AppData\Local\Temp\ct3317893\xpi\defaults\preferences\defaults.js (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. (Ende) Malwarebytes heute: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.12.04 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 11.0.9600.16476 Margret :: MARGRET-PC [Administrator] 12.01.2014 10:05:28 mbam-log-2014-01-12 (10-05-28).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 196660 Laufzeit: 6 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Adwcleaner: Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 12/01/2014 um 10:30:39 # Aktualisiert 23/12/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits) # Benutzername : Margret - MARGRET-PC # Gestartet von : C:\Users\Margret\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Conduit Ordner Gelöscht : C:\Program Files\Conduit Ordner Gelöscht : C:\Windows\system32\Searchprotect Ordner Gelöscht : C:\Users\Margret\AppData\Local\Conduit Ordner Gelöscht : C:\Users\Margret\AppData\Local\DownloadGuide Ordner Gelöscht : C:\Users\Margret\AppData\Local\SwvUpdater Ordner Gelöscht : C:\Users\Margret\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Margret\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Margret\AppData\Roaming\Windows Net Data Ordner Gelöscht : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\CT3317893 Ordner Gelöscht : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM Ordner Gelöscht : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\Extensions\{61f0d019-b016-4d56-9dae-7b7706cd6755} Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\nsprotector.js Datei Gelöscht : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\searchplugins\Conduit.xml Datei Gelöscht : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\searchplugins\conduit-search.xml Datei Gelöscht : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\user.js Datei Gelöscht : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\{DefaultProfilesFolder}\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B89DC353-2E4F-4969-B1F0-5159CB7E7AD5} [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B89DC353-2E4F-4969-B1F0-5159CB7E7AD5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3317893 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gelöscht : HKCU\Software\Conduit Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar Schlüssel Gelöscht : HKLM\Software\Conduit Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536 ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16428 -\\ Mozilla Firefox v26.0 (de) [ Datei : C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default\prefs.js ] Zeile gelöscht : user_pref("CT3317893.FF19Solved", "true"); Zeile gelöscht : user_pref("CT3317893.UserID", "UN15380372102735323"); Zeile gelöscht : user_pref("CT3317893.browser.search.defaultthis.engineName", "true"); Zeile gelöscht : user_pref("CT3317893.fullUserID", "UN15380372102735323.IN.20131214094853"); Zeile gelöscht : user_pref("CT3317893.installDate", "14/12/2013 09:48:56"); Zeile gelöscht : user_pref("CT3317893.installSessionId", "{817F84B4-14D2-4F5C-973E-F89A64F34457}"); Zeile gelöscht : user_pref("CT3317893.installSp", "TRUE"); Zeile gelöscht : user_pref("CT3317893.installerVersion", "1.8.1.4"); Zeile gelöscht : user_pref("CT3317893.keyword", "true"); Zeile gelöscht : user_pref("CT3317893.originalHomepage", "hxxp://www.google.de/"); Zeile gelöscht : user_pref("CT3317893.originalSearchAddressUrl", ""); Zeile gelöscht : user_pref("CT3317893.originalSearchEngine", ""); Zeile gelöscht : user_pref("CT3317893.originalSearchEngineName", ""); Zeile gelöscht : user_pref("CT3317893.searchRevert", "true"); Zeile gelöscht : user_pref("CT3317893.searchUninstallUserMode", "2"); Zeile gelöscht : user_pref("CT3317893.searchUserMode", "2"); Zeile gelöscht : user_pref("CT3317893.smartbar.homepage", "true"); Zeile gelöscht : user_pref("CT3317893.toolbarInstallDate", "14-12-2013 09:48:53"); Zeile gelöscht : user_pref("CT3317893.versionFromInstaller", "10.23.0.722"); Zeile gelöscht : user_pref("CT3317893.xpeMode", "0"); Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3317893&octid=CT3317893&SearchSource=61&CUI=UN15380372102735323&UM=2&UP=SP2C187999-612A-41B0-A150-E5F4E596909B"); Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", ""); Zeile gelöscht : user_pref("browser.search.defaultenginename", "RadioTotal4 Customized Web Search"); Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "RadioTotal4 Customized Web Search"); Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317893&CUI=UN15380372102735323&UM=2&SearchSource=3&q={searchTerms}"); Zeile gelöscht : user_pref("browser.search.selectedEngine", "RadioTotal4 Customized Web Search"); Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3317893&octid=CT3317893&SearchSource=61&CUI=UN15380372102735323&UM=2&UP=SP2C187999-612A-41B0-A150-E5F4E596909B"); Zeile gelöscht : user_pref("extensions.wajam.affiliate_id", "6370"); Zeile gelöscht : user_pref("extensions.wajam.firstrun", "false"); Zeile gelöscht : user_pref("extensions.wajam.log_send_info", "false"); Zeile gelöscht : user_pref("extensions.wajam.mappingListJsonString", "{\"version\":\"0.21087\",\"update_interval\":1400,\"base_url\":\"hxxp:\\/\\/www.wajam.com\\/\",\"update_url\":\"hxxp:\\/\\/www.wajam.com\\/addon\\/[...] Zeile gelöscht : user_pref("extensions.wajam.no_trace", "false"); Zeile gelöscht : user_pref("extensions.wajam.server_current_mapping_version", "0.21087"); Zeile gelöscht : user_pref("extensions.wajam.supported_sites.amazon_v2.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';wind[...] Zeile gelöscht : user_pref("extensions.wajam.supported_sites.ebay_v2.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';window[...] Zeile gelöscht : user_pref("extensions.wajam.supported_sites.encryptedgoogle.wajam_google_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'W[...] Zeile gelöscht : user_pref("extensions.wajam.supported_sites.youtubesearch.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';[...] Zeile gelöscht : user_pref("extensions.wajam.trace_log", "1388400024137 - onFlagInfoReceived - Saving server mapping version\n1388400024137 - onFlagInfoReceived - No user current mapping version specified, set to '0'\[...] Zeile gelöscht : user_pref("extensions.wajam.unique_id", "AA4676DAAE0CFE83EABCD0DBC509D417"); Zeile gelöscht : user_pref("extensions.wajam.user_current_mapping_version", "0"); Zeile gelöscht : user_pref("extensions.wajam.version", "1.26"); Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317893&SearchSource=2&CUI=UN15380372102735323&UM=2&q="); Zeile gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT3317893"); Zeile gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3317893&CUI=UN15380372102735323&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3317893&octid=CT3317893&SearchSource[...] Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3317893&SearchSource=2&CUI=UN15380372102735323&UM=2&q="); Zeile gelöscht : user_pref("smartbar.defaultSearchOwnerCTID", "CT3317893"); Zeile gelöscht : user_pref("smartbar.homePageOwnerCTID", "CT3317893"); Zeile gelöscht : user_pref("smartbar.machineId", "LPWF17BGVBHOAK14GO/W4FV2TBRTXQR3SLOZIXTHGP7P3SD3ERTPI2XFYYF6A20XDPNGQA9GL685YCD/MKW7XA"); Zeile gelöscht : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3317893&CUI=UN15380372102735323&UM=2&SearchSource=13"); ************************* AdwCleaner[R0].txt - [9370 octets] - [12/01/2014 10:28:36] AdwCleaner[S0].txt - [9189 octets] - [12/01/2014 10:30:39] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9249 octets] ########## JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.0 (01.07.2014:1) OS: Windows 7 Home Premium x86 Ran by Margret on 12.01.2014 at 10:37:15,73 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1534CFE4-50E4-4504-B3CF-5AFEBA99342D} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\apn" ~~~ FireFox Emptied folder: C:\Users\Margret\AppData\Roaming\mozilla\firefox\profiles\vmelvqpn.default\minidumps [42 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 12.01.2014 at 10:39:49,22 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST (frisch): FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-01-2014 03 Ran by Margret (administrator) on MARGRET-PC on 12-01-2014 10:40:56 Running from C:\Users\Margret\Desktop Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (Lenovo.) C:\Windows\System32\ibmpmsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareService.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (Lenovo Group Limited) C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe () C:\ProgramData\dlprotect.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareTray.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [TPFNF7] - C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe [62240 2009-08-04] (Lenovo Group Limited) HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe [63784 2013-03-18] (Lenovo) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM\...\Run: [Download Protect] - C:\ProgramData\dlprotect.exe [12800 2013-12-14] () HKLM\...\Run: [] - [x] HKLM\...\Run: [AdAwareTray] - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareTray.exe [3540312 2013-12-11] () HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) Lsa: [Notification Packages] scecli ACGina ==================== Internet (Whitelisted) ==================== SearchScopes: HKLM - DefaultScope value is missing. BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM\...\Firefox\Extensions: [ext@VideoPlayerV3beta690.net] - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta690\ff FF Extension: Video Player - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta690\ff [2014-01-09] ========================== Services (Whitelisted) ================= R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [133416 2013-03-18] (Lenovo) R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [272680 2013-03-18] (Lenovo) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-28] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG) R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.) R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareService.exe [494136 2013-12-11] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-28] (Avira Operations GmbH & Co. KG) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-16] (Avira GmbH) R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [340624 2013-07-17] (BitDefender S.R.L.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-12 10:40 - 2014-01-12 10:40 - 00007013 _____ C:\Users\Margret\Desktop\FRST.txt 2014-01-12 10:39 - 2014-01-12 10:39 - 00001276 _____ C:\Users\Margret\Desktop\JRT.txt 2014-01-12 10:37 - 2014-01-12 10:37 - 00000000 ____D C:\Windows\ERUNT 2014-01-12 10:36 - 2014-01-12 10:36 - 01037068 _____ (Thisisu) C:\Users\Margret\Desktop\JRT.exe 2014-01-12 10:35 - 2014-01-12 10:35 - 00009329 _____ C:\Users\Margret\Desktop\AdwCleaner[S0].txt 2014-01-12 10:28 - 2014-01-12 10:31 - 00000000 ____D C:\AdwCleaner 2014-01-12 10:27 - 2014-01-12 10:27 - 01233962 _____ C:\Users\Margret\Desktop\adwcleaner.exe 2014-01-11 22:45 - 2014-01-11 22:45 - 00000000 ____D C:\FRST 2014-01-11 22:44 - 2014-01-11 22:44 - 01220096 _____ (Farbar) C:\Users\Margret\Desktop\FRST.exe 2014-01-11 18:57 - 2014-01-11 18:57 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Margret\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-11 18:56 - 2014-01-11 18:56 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2014-01-11 18:56 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-01-11 18:46 - 2014-01-11 18:46 - 00001608 _____ C:\Users\Margret\Desktop\Ad-Aware_Report_Full_Manual_2014-01-11T18-45-02.721864.xml 2014-01-11 18:11 - 2014-01-11 18:11 - 00000000 ____D C:\Users\Margret\AppData\Roaming\LavasoftStatistics 2014-01-11 17:58 - 2014-01-12 10:32 - 00002305 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Lavasoft 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Program Files\Lavasoft 2014-01-11 17:55 - 2014-01-11 17:55 - 00000000 ____D C:\Program Files\Common Files\Lavasoft 2014-01-11 17:54 - 2014-01-11 17:54 - 00000000 ____D C:\ProgramData\Lavasoft 2014-01-11 17:53 - 2014-01-11 17:53 - 01725064 _____ C:\Users\Margret\Downloads\Adaware_Installer_11.1.exe 2014-01-09 21:22 - 2014-01-09 21:22 - 00000000 ____D C:\Program Files\VideoPlayerV3 2013-12-23 22:51 - 2013-12-23 22:51 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-12-14 09:49 - 2013-12-14 09:49 - 00012800 _____ C:\ProgramData\dlprotect.exe 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\Google 2013-12-14 09:48 - 2013-12-14 09:48 - 00566423 _____ C:\Users\Margret\Downloads\installminecraft.dmg 2013-12-14 09:48 - 2013-12-14 09:48 - 00000159 _____ C:\Users\Margret\Desktop\100 Euro Guthaben.url ==================== One Month Modified Files and Folders ======= 2014-01-12 10:41 - 2014-01-12 10:40 - 00007013 _____ C:\Users\Margret\Desktop\FRST.txt 2014-01-12 10:40 - 2009-07-14 05:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-12 10:40 - 2009-07-14 05:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-12 10:39 - 2014-01-12 10:39 - 00001276 _____ C:\Users\Margret\Desktop\JRT.txt 2014-01-12 10:39 - 2010-11-20 22:01 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-12 10:37 - 2014-01-12 10:37 - 00000000 ____D C:\Windows\ERUNT 2014-01-12 10:36 - 2014-01-12 10:36 - 01037068 _____ (Thisisu) C:\Users\Margret\Desktop\JRT.exe 2014-01-12 10:35 - 2014-01-12 10:35 - 00009329 _____ C:\Users\Margret\Desktop\AdwCleaner[S0].txt 2014-01-12 10:35 - 2013-07-18 12:18 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Skype 2014-01-12 10:32 - 2014-01-11 17:58 - 00002305 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-01-12 10:32 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-12 10:32 - 2009-07-14 05:39 - 00038946 _____ C:\Windows\setupact.log 2014-01-12 10:31 - 2014-01-12 10:28 - 00000000 ____D C:\AdwCleaner 2014-01-12 10:31 - 2013-07-16 14:44 - 01913544 _____ C:\Windows\WindowsUpdate.log 2014-01-12 10:27 - 2014-01-12 10:27 - 01233962 _____ C:\Users\Margret\Desktop\adwcleaner.exe 2014-01-11 22:45 - 2014-01-11 22:45 - 00000000 ____D C:\FRST 2014-01-11 22:44 - 2014-01-11 22:44 - 01220096 _____ (Farbar) C:\Users\Margret\Desktop\FRST.exe 2014-01-11 20:55 - 2010-11-20 22:48 - 00025396 _____ C:\Windows\PFRO.log 2014-01-11 20:55 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\addins 2014-01-11 18:57 - 2014-01-11 18:57 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Margret\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-11 18:56 - 2014-01-11 18:56 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2014-01-11 18:46 - 2014-01-11 18:46 - 00001608 _____ C:\Users\Margret\Desktop\Ad-Aware_Report_Full_Manual_2014-01-11T18-45-02.721864.xml 2014-01-11 18:11 - 2014-01-11 18:11 - 00000000 ____D C:\Users\Margret\AppData\Roaming\LavasoftStatistics 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Lavasoft 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Program Files\Lavasoft 2014-01-11 17:55 - 2014-01-11 17:55 - 00000000 ____D C:\Program Files\Common Files\Lavasoft 2014-01-11 17:54 - 2014-01-11 17:54 - 00000000 ____D C:\ProgramData\Lavasoft 2014-01-11 17:53 - 2014-01-11 17:53 - 01725064 _____ C:\Users\Margret\Downloads\Adaware_Installer_11.1.exe 2014-01-09 21:23 - 2013-07-26 16:53 - 00000000 ____D C:\Users\Margret\Documents\Freundeskreis Gronau-Pfaffenheim 2014-01-09 21:22 - 2014-01-09 21:22 - 00000000 ____D C:\Program Files\VideoPlayerV3 2013-12-29 10:33 - 2013-07-16 15:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-12-23 22:51 - 2013-12-23 22:51 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-12-18 22:47 - 2013-07-18 11:56 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-12-18 22:47 - 2013-07-16 14:56 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-12-18 22:47 - 2013-07-16 14:56 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-12-17 20:24 - 2013-07-18 12:18 - 00000000 ___RD C:\Program Files\Skype 2013-12-17 20:24 - 2013-07-18 12:18 - 00000000 ____D C:\ProgramData\Skype 2013-12-16 19:22 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\system32\FxsTmp 2013-12-14 09:49 - 2013-12-14 09:49 - 00012800 _____ C:\ProgramData\dlprotect.exe 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\Google 2013-12-14 09:48 - 2013-12-14 09:48 - 00566423 _____ C:\Users\Margret\Downloads\installminecraft.dmg 2013-12-14 09:48 - 2013-12-14 09:48 - 00000159 _____ C:\Users\Margret\Desktop\100 Euro Guthaben.url 2013-12-14 09:30 - 2009-07-14 05:33 - 00406584 _____ C:\Windows\system32\FNTCACHE.DAT 2013-12-14 09:28 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE Files to move or delete: ==================== C:\ProgramData\dlprotect.exe Some content of TEMP: ==================== C:\Users\Margret\AppData\Local\Temp\avgnt.exe C:\Users\Margret\AppData\Local\Temp\ose00000.exe C:\Users\Margret\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-11 09:03 ==================== End Of Log ============================ |
13.01.2014, 09:38 | #4 |
/// the machine /// TB-Ausbilder | search.conduit - Werbebanner und Pop-UpsESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
13.01.2014, 11:45 | #5 |
| search.conduit - Werbebanner und Pop-Ups Ja, das Problem besteht weiterhin. Mit den letzten beiden Tools wurde ja auch nur gescannt und nicht gefixt. Hier die gewuenschten Log Files: Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=04f36b4255d1f3459fedd032e1f1aa00 # engine=16628 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-01-13 10:19:45 # local_time=2014-01-13 11:19:45 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1799 16775165 100 95 5157 15625504 0 0 # compatibility_mode=5893 16776574 66 85 15458605 141239576 0 0 # scanned=88300 # found=1 # cleaned=0 # scan_time=1368 sh=FE7E7F58532FE44870EF1458D993CB2B3B8931F9 ft=0 fh=0000000000000000 vn="a variant of OSX/Adware.Genieo.A application" ac=I fn="C:\Users\Margret\Downloads\installminecraft.dmg" Code:
ATTFilter Results of screen317's Security Check version 0.99.78 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Ad-Aware Antivirus Avira Desktop Antivirus out of date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Ad-Aware Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.8.800.94 Adobe Reader XI Mozilla Firefox (26.0) Mozilla Thunderbird (24.2.0) ````````Process Check: objlist.exe by Laurent```````` Ad-Aware AAWService.exe is disabled! Ad-Aware AAWTray.exe is disabled! Avira Antivir avgnt.exe Avira Antivir avguard.exe Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5152.0\AdAwareService.exe Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5152.0\AdAwareTray.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-01-2014 01 Ran by Margret (administrator) on MARGRET-PC on 13-01-2014 11:32:23 Running from C:\Users\Margret\Desktop Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (Lenovo.) C:\Windows\System32\ibmpmsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareService.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Lenovo Group Limited) C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe () C:\ProgramData\dlprotect.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareTray.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [TPFNF7] - C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe [62240 2009-08-04] (Lenovo Group Limited) HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe [63784 2013-03-18] (Lenovo) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM\...\Run: [Download Protect] - C:\ProgramData\dlprotect.exe [12800 2013-12-14] () HKLM\...\Run: [] - [x] HKLM\...\Run: [AdAwareTray] - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareTray.exe [3540312 2013-12-11] () HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) Lsa: [Notification Packages] scecli ACGina ==================== Internet (Whitelisted) ==================== SearchScopes: HKLM - DefaultScope value is missing. BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Margret\AppData\Roaming\Mozilla\Firefox\Profiles\vmelvqpn.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM\...\Firefox\Extensions: [ext@VideoPlayerV3beta690.net] - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta690\ff FF Extension: Video Player - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta690\ff [2014-01-09] ========================== Services (Whitelisted) ================= R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [133416 2013-03-18] (Lenovo) R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [272680 2013-03-18] (Lenovo) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-28] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG) R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.) R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5152.0\AdAwareService.exe [494136 2013-12-11] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-28] (Avira Operations GmbH & Co. KG) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-16] (Avira GmbH) R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [340624 2013-07-17] (BitDefender S.R.L.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-13 11:32 - 2014-01-13 11:32 - 00007430 _____ C:\Users\Margret\Desktop\FRST.txt 2014-01-13 11:32 - 2014-01-13 11:32 - 00000000 ____D C:\Users\Margret\Desktop\FRST-OlderVersion 2014-01-13 11:31 - 2014-01-13 11:31 - 00001175 _____ C:\Users\Margret\Desktop\checkup.txt 2014-01-13 11:22 - 2014-01-13 11:22 - 00987410 _____ C:\Users\Margret\Desktop\SecurityCheck.exe 2014-01-13 10:52 - 2014-01-13 10:52 - 02347384 _____ (ESET) C:\Users\Margret\Desktop\esetsmartinstaller_enu.exe 2014-01-12 10:40 - 2014-01-12 10:41 - 00015371 _____ C:\Users\Margret\Desktop\FRST alt.txt 2014-01-12 10:39 - 2014-01-12 10:39 - 00001276 _____ C:\Users\Margret\Desktop\JRT.txt 2014-01-12 10:37 - 2014-01-12 10:37 - 00000000 ____D C:\Windows\ERUNT 2014-01-12 10:36 - 2014-01-12 10:36 - 01037068 _____ (Thisisu) C:\Users\Margret\Desktop\JRT.exe 2014-01-12 10:35 - 2014-01-12 10:35 - 00009329 _____ C:\Users\Margret\Desktop\AdwCleaner[S0].txt 2014-01-12 10:28 - 2014-01-12 10:31 - 00000000 ____D C:\AdwCleaner 2014-01-12 10:27 - 2014-01-12 10:27 - 01233962 _____ C:\Users\Margret\Desktop\adwcleaner.exe 2014-01-11 22:45 - 2014-01-13 11:32 - 00000000 ____D C:\FRST 2014-01-11 22:44 - 2014-01-13 11:32 - 01219584 _____ (Farbar) C:\Users\Margret\Desktop\FRST.exe 2014-01-11 18:57 - 2014-01-11 18:57 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Margret\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-11 18:56 - 2014-01-11 18:56 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2014-01-11 18:56 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-01-11 18:46 - 2014-01-11 18:46 - 00001608 _____ C:\Users\Margret\Desktop\Ad-Aware_Report_Full_Manual_2014-01-11T18-45-02.721864.xml 2014-01-11 18:11 - 2014-01-11 18:11 - 00000000 ____D C:\Users\Margret\AppData\Roaming\LavasoftStatistics 2014-01-11 17:58 - 2014-01-13 10:51 - 00002305 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Lavasoft 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Program Files\Lavasoft 2014-01-11 17:55 - 2014-01-11 17:55 - 00000000 ____D C:\Program Files\Common Files\Lavasoft 2014-01-11 17:54 - 2014-01-11 17:54 - 00000000 ____D C:\ProgramData\Lavasoft 2014-01-11 17:53 - 2014-01-11 17:53 - 01725064 _____ C:\Users\Margret\Downloads\Adaware_Installer_11.1.exe 2014-01-09 21:22 - 2014-01-09 21:22 - 00000000 ____D C:\Program Files\VideoPlayerV3 2013-12-23 22:51 - 2013-12-23 22:51 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-12-14 09:49 - 2013-12-14 09:49 - 00012800 _____ C:\ProgramData\dlprotect.exe 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\Google 2013-12-14 09:48 - 2013-12-14 09:48 - 00566423 _____ C:\Users\Margret\Downloads\installminecraft.dmg 2013-12-14 09:48 - 2013-12-14 09:48 - 00000159 _____ C:\Users\Margret\Desktop\100 Euro Guthaben.url ==================== One Month Modified Files and Folders ======= 2014-01-13 11:32 - 2014-01-13 11:32 - 00007430 _____ C:\Users\Margret\Desktop\FRST.txt 2014-01-13 11:32 - 2014-01-13 11:32 - 00000000 ____D C:\Users\Margret\Desktop\FRST-OlderVersion 2014-01-13 11:32 - 2014-01-11 22:45 - 00000000 ____D C:\FRST 2014-01-13 11:32 - 2014-01-11 22:44 - 01219584 _____ (Farbar) C:\Users\Margret\Desktop\FRST.exe 2014-01-13 11:31 - 2014-01-13 11:31 - 00001175 _____ C:\Users\Margret\Desktop\checkup.txt 2014-01-13 11:22 - 2014-01-13 11:22 - 00987410 _____ C:\Users\Margret\Desktop\SecurityCheck.exe 2014-01-13 11:05 - 2013-07-18 12:18 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Skype 2014-01-13 10:57 - 2009-07-14 05:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-13 10:57 - 2009-07-14 05:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-13 10:54 - 2010-11-20 22:01 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-13 10:53 - 2013-07-16 14:44 - 01933679 _____ C:\Windows\WindowsUpdate.log 2014-01-13 10:52 - 2014-01-13 10:52 - 02347384 _____ (ESET) C:\Users\Margret\Desktop\esetsmartinstaller_enu.exe 2014-01-13 10:51 - 2014-01-11 17:58 - 00002305 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-01-13 10:48 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-13 10:48 - 2009-07-14 05:39 - 00039002 _____ C:\Windows\setupact.log 2014-01-12 10:41 - 2014-01-12 10:40 - 00015371 _____ C:\Users\Margret\Desktop\FRST alt.txt 2014-01-12 10:39 - 2014-01-12 10:39 - 00001276 _____ C:\Users\Margret\Desktop\JRT.txt 2014-01-12 10:37 - 2014-01-12 10:37 - 00000000 ____D C:\Windows\ERUNT 2014-01-12 10:36 - 2014-01-12 10:36 - 01037068 _____ (Thisisu) C:\Users\Margret\Desktop\JRT.exe 2014-01-12 10:35 - 2014-01-12 10:35 - 00009329 _____ C:\Users\Margret\Desktop\AdwCleaner[S0].txt 2014-01-12 10:31 - 2014-01-12 10:28 - 00000000 ____D C:\AdwCleaner 2014-01-12 10:27 - 2014-01-12 10:27 - 01233962 _____ C:\Users\Margret\Desktop\adwcleaner.exe 2014-01-11 20:55 - 2010-11-20 22:48 - 00025396 _____ C:\Windows\PFRO.log 2014-01-11 20:55 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\addins 2014-01-11 18:57 - 2014-01-11 18:57 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Margret\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-11 18:56 - 2014-01-11 18:56 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-11 18:56 - 2014-01-11 18:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2014-01-11 18:46 - 2014-01-11 18:46 - 00001608 _____ C:\Users\Margret\Desktop\Ad-Aware_Report_Full_Manual_2014-01-11T18-45-02.721864.xml 2014-01-11 18:11 - 2014-01-11 18:11 - 00000000 ____D C:\Users\Margret\AppData\Roaming\LavasoftStatistics 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Users\Margret\AppData\Roaming\Lavasoft 2014-01-11 17:56 - 2014-01-11 17:56 - 00000000 ____D C:\Program Files\Lavasoft 2014-01-11 17:55 - 2014-01-11 17:55 - 00000000 ____D C:\Program Files\Common Files\Lavasoft 2014-01-11 17:54 - 2014-01-11 17:54 - 00000000 ____D C:\ProgramData\Lavasoft 2014-01-11 17:53 - 2014-01-11 17:53 - 01725064 _____ C:\Users\Margret\Downloads\Adaware_Installer_11.1.exe 2014-01-09 21:23 - 2013-07-26 16:53 - 00000000 ____D C:\Users\Margret\Documents\Freundeskreis Gronau-Pfaffenheim 2014-01-09 21:22 - 2014-01-09 21:22 - 00000000 ____D C:\Program Files\VideoPlayerV3 2013-12-29 10:33 - 2013-07-16 15:00 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-12-23 22:51 - 2013-12-23 22:51 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-12-18 22:47 - 2013-07-18 11:56 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-12-18 22:47 - 2013-07-16 14:56 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-12-18 22:47 - 2013-07-16 14:56 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-12-17 20:24 - 2013-07-18 12:18 - 00000000 ___RD C:\Program Files\Skype 2013-12-17 20:24 - 2013-07-18 12:18 - 00000000 ____D C:\ProgramData\Skype 2013-12-16 19:22 - 2009-07-14 05:52 - 00000000 ____D C:\Windows\system32\FxsTmp 2013-12-14 09:49 - 2013-12-14 09:49 - 00012800 _____ C:\ProgramData\dlprotect.exe 2013-12-14 09:49 - 2013-12-14 09:49 - 00000000 ____D C:\Users\Margret\AppData\Local\Google 2013-12-14 09:48 - 2013-12-14 09:48 - 00566423 _____ C:\Users\Margret\Downloads\installminecraft.dmg 2013-12-14 09:48 - 2013-12-14 09:48 - 00000159 _____ C:\Users\Margret\Desktop\100 Euro Guthaben.url 2013-12-14 09:30 - 2009-07-14 05:33 - 00406584 _____ C:\Windows\system32\FNTCACHE.DAT 2013-12-14 09:28 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE Files to move or delete: ==================== C:\ProgramData\dlprotect.exe Some content of TEMP: ==================== C:\Users\Margret\AppData\Local\Temp\avgnt.exe C:\Users\Margret\AppData\Local\Temp\ose00000.exe C:\Users\Margret\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-11 09:03 ==================== End Of Log ============================ Uebrigens hat sich gerade mein Avira-Scanner gemeldet und meinte die Datei FRST.exe sei infiziert!? |
14.01.2014, 09:21 | #6 |
/// the machine /// TB-Ausbilder | search.conduit - Werbebanner und Pop-Ups Avira hat nen Macken. In welchem Browser haste immer noch Stress?
__________________ --> search.conduit - Werbebanner und Pop-Ups |
14.01.2014, 20:46 | #7 |
| search.conduit - Werbebanner und Pop-Ups Problem besteht offenbar nur in Firefox. Habe gerade mal IE11 probiert, da gehen keine Werbe-Pop-Ups auf und es werden auch keine Textteile von Webseiten mit Werbelinks versehen. Wie bekomme ich das im Firefox weg? |
15.01.2014, 12:44 | #8 |
/// the machine /// TB-Ausbilder | search.conduit - Werbebanner und Pop-Ups Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Noch Probleme? Frisches FRST Log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu search.conduit - Werbebanner und Pop-Ups |
ad-aware, antivir, browser, download protect, excel, flash player, google startseite, homepage, osx/adware.genieo.a, pup.optional.bundleinstaller.a, pup.optional.conduit, pup.optional.conduit.a, pup.optional.searchprotect.a, pup.optional.softwareupdater, pup.optional.wajam, pup.optional.wajam.a, pup.optional.webexp, pup.software.updater, registry, security, services.exe, software, svchost.exe, temp, windows |