Backdoor- und Trojan-Agents mit MalwareBytes entdeckt

912946 · 16.01.2014, 22:10

Hallo!

Beim Routinescan hat Malwarebytes 3 Bedrohungen gefunden, wobei eine vom Tool "Tinypic" stammt, das ich schon lange im Einsatz habe und bisher nie angemeckert wurde. Die 2. Bedrohung "Windows7Loader.exe (Trojan.Agent.W)" ist mir neu.

Habe auf eurer hp zum Stichwort "Backdoor.Agent.FPA nach Routinescan mit Malwarebytes entdeckt" schon Literatur zum Thema entdeckt und poste hier mal die Scanergebnisse von mbam und frst mit der Bitte um Begutachtung. Gleichzeitig würde mich interessieren, wo man was aus der frst.txt rauslesen kann.

Danke im Voraus & Gruß,
Susanne

Nachtrag: Mein Virenprogramm G Data hat diese Bedrohungen nicht gemeldet.

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.16.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Susanne :: ASUS-NOTEBOOK [Administrator]

16.01.2014 19:07:36
MBAM-log-2014-01-16 (21-27-03).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 399687
Laufzeit: 2 Stunde(n), 12 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Windows\Setup\Scripts\Windows7Loader.exe (Trojan.Agent.W) -> Keine Aktion durchgeführt.
D:\Mozilla Firefox Downloads\TinyPicSetup.exe (Backdoor.Agent.FPA) -> Keine Aktion durchgeführt.
D:\_für neues Notebook\sonst von C alter PC\C\Eigene Dateien\Downloads\TinyPicSetup.exe (Backdoor.Agent.FPA) -> Keine Aktion durchgeführt.

(Ende)

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 03
Ran by Susanne (administrator) on ASUS-NOTEBOOK on 16-01-2014 21:35:58
Running from C:\Users\Susanne\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Farbar) C:\Users\Susanne\Desktop\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [16330272 2009-07-02] (NVIDIA Corporation)
HKLM\...\Run: [IntelliType Pro] - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464984 2012-10-12] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2075288 2012-10-12] (Microsoft Corporation)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444304 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] - C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [472016 2013-02-25] (G Data Software AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844168 2013-06-10] (Samsung)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_9_900_170_Plugin.exe -update plugin [839560 2013-12-11] (Adobe Systems Incorporated)
MountPoints2: {e6d7357b-1a7a-11e2-8d39-002243619954} - F:\AutoRun.exe
MountPoints2: {e6d73591-1a7a-11e2-8d39-002243619954} - F:\AutoRun.exe
HKU\Administrator\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-04-23] (Samsung)
HKU\Administrator\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2013-04-18] (Samsung Electronics)
HKU\Administrator\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844168 2013-06-10] (Samsung)
HKU\Administrator\...\Run: [DriverScanner] - "C:\Program Files (x86)\Uniblue\DriverScanner\launcher.exe" delay 20000 
HKU\Administrator\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7FEC8C782FAECD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.orf.at/
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Tcpip\..\Interfaces\{B8A9105E-F11D-4AE4-92E1-C9FC0C359C72}: [NameServer]10.0.0.138,195.3.96.67

FireFox:
========
FF ProfilePath: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\qkhwuboy.default
FF Homepage: hxxp://kurier.at/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\qkhwuboy.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-30]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2014-01-06]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2014-01-06]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-12-20]

==================== Services (Whitelisted) =================

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1957840 2013-03-22] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635344 2013-02-25] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2556384 2013-07-02] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2926672 2013-03-22] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [696808 2013-02-25] (G Data Software AG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

==================== Drivers (Whitelisted) ====================

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-04-18] ()
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2013-08-13] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [130392 2013-08-13] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [62808 2013-08-12] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2013-08-13] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-08-13] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65368 2013-08-13] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATK64AMD.sys [13680 2007-08-09] ()
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-16 21:35 - 2014-01-16 21:35 - 00014375 _____ C:\Users\Susanne\Desktop\FRST.txt
2014-01-16 21:35 - 2014-01-16 21:33 - 02076160 _____ (Farbar) C:\Users\Susanne\Desktop\FRST64(1).exe
2014-01-06 17:35 - 2014-01-06 17:35 - 00000000 ____D C:\ProgramData\Sun
2014-01-06 17:34 - 2014-01-06 17:34 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-06 17:34 - 2014-01-06 17:34 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-06 17:32 - 2014-01-06 17:32 - 00915368 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\JavaSetup7u45.com
2014-01-06 17:01 - 2014-01-06 17:35 - 00000000 ____D C:\ProgramData\Oracle
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung.lnk
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung (2).lnk
2014-01-06 17:01 - 2014-01-06 17:00 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-06 17:00 - 2014-01-06 17:00 - 00000000 ____D C:\Program Files\Java
2014-01-06 16:58 - 2014-01-06 16:59 - 30694824 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\jre-7u45-windows-x64.com
2014-01-06 16:33 - 2014-01-06 16:33 - 00001247 _____ C:\Windows\IE9_main.log
2014-01-06 16:28 - 2014-01-06 16:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-25 03:56 - 2013-12-25 04:29 - 00000000 ____D C:\AdwCleaner
2013-12-25 03:12 - 2013-12-25 03:12 - 00001118 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Malwarebytes
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-25 03:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-19 09:32 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-19 09:32 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-19 09:32 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-19 09:32 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-19 09:27 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-19 09:27 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-19 09:27 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-19 09:27 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-19 09:27 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-19 09:27 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-19 09:27 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-19 09:27 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-19 09:27 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-19 09:27 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-19 09:27 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-19 09:27 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-19 09:27 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-19 09:27 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-19 09:27 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-19 09:27 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-19 09:27 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-19 09:27 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-19 09:27 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-19 09:27 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-19 09:27 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-19 09:27 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-19 09:27 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-19 09:27 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-19 09:27 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-19 09:27 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-19 09:27 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-19 09:27 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-19 09:27 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-19 09:27 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-19 09:27 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

==================== One Month Modified Files and Folders =======

2014-01-16 21:36 - 2014-01-16 21:35 - 00014375 _____ C:\Users\Susanne\Desktop\FRST.txt
2014-01-16 21:33 - 2014-01-16 21:35 - 02076160 _____ (Farbar) C:\Users\Susanne\Desktop\FRST64(1).exe
2014-01-16 21:28 - 2012-10-23 22:54 - 00000000 ___RD C:\Users\Susanne\Desktop\PC Aufräumen
2014-01-16 21:09 - 2012-10-19 19:02 - 01397999 _____ C:\Windows\WindowsUpdate.log
2014-01-16 20:57 - 2013-09-18 08:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-16 16:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\tracing
2014-01-16 16:04 - 2009-07-14 05:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-16 16:04 - 2009-07-14 05:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-16 15:56 - 2013-10-09 09:43 - 00002589 _____ C:\Windows\setupact.log
2014-01-16 15:56 - 2013-10-06 14:49 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2014-01-16 15:56 - 2012-10-19 20:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-16 15:56 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-06 18:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2014-01-06 17:35 - 2014-01-06 17:35 - 00000000 ____D C:\ProgramData\Sun
2014-01-06 17:35 - 2014-01-06 17:01 - 00000000 ____D C:\ProgramData\Oracle
2014-01-06 17:34 - 2014-01-06 17:34 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-06 17:34 - 2014-01-06 17:34 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-06 17:32 - 2014-01-06 17:32 - 00915368 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\JavaSetup7u45.com
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung.lnk
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung (2).lnk
2014-01-06 17:00 - 2014-01-06 17:01 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-06 17:00 - 2014-01-06 17:00 - 00000000 ____D C:\Program Files\Java
2014-01-06 16:59 - 2014-01-06 16:58 - 30694824 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\jre-7u45-windows-x64.com
2014-01-06 16:33 - 2014-01-06 16:33 - 00001247 _____ C:\Windows\IE9_main.log
2014-01-06 16:29 - 2014-01-06 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-25 05:02 - 2011-04-12 08:43 - 00657910 _____ C:\Windows\system32\perfh007.dat
2013-12-25 05:02 - 2011-04-12 08:43 - 00131250 _____ C:\Windows\system32\perfc007.dat
2013-12-25 05:02 - 2009-07-14 06:13 - 01507342 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-25 04:31 - 2013-10-09 09:43 - 00002206 _____ C:\Windows\PFRO.log
2013-12-25 04:29 - 2013-12-25 03:56 - 00000000 ____D C:\AdwCleaner
2013-12-25 04:29 - 2013-08-15 00:50 - 00000000 ____D C:\ProgramData\Uniblue
2013-12-25 04:29 - 2012-12-31 15:29 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Uniblue
2013-12-25 04:29 - 2012-12-31 15:29 - 00000000 ____D C:\Program Files (x86)\Uniblue
2013-12-25 03:12 - 2013-12-25 03:12 - 00001118 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Malwarebytes
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-19 11:11 - 2013-08-15 00:55 - 00000000 ____D C:\Windows\system32\MRT
2013-12-19 11:09 - 2012-01-10 19:35 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-19 09:49 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-19 09:48 - 2009-07-14 05:45 - 00428152 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-19 09:32 - 2012-10-19 22:13 - 00000000 ____D C:\ProgramData\Microsoft Help

Some content of TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\install_flashplayer11x32au_mssa_aaa_aih.exe
C:\Users\Susanne\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-06 18:23

==================== End Of Log ============================

--- --- ---
--- --- ---

--- --- ---

--- --- ---

schrauber · 17.01.2014, 08:17

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

912946 · 17.01.2014, 17:23

Hi, combofix.txt ist so groß, dass ich in 2 Arbeitsgängen posten muss.

Teil 1:

Code:

ATTFilter

ComboFix 14-01-16.03 - Susanne 17.01.2014  16:07:23.1.2 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.3071.1953 [GMT 1:00]
ausgeführt von:: c:\users\Susanne\Desktop\ComboFix.exe
AV: G Data InternetSecurity 2014 *Disabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}
FW: G Data Personal Firewall *Disabled* {018C0191-29AD-04E8-101F-264FDF37B3ED}
SP: G Data InternetSecurity 2014 *Disabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-12-17 bis 2014-01-17  ))))))))))))))))))))))))))))))
.
.
2014-01-17 15:17 . 2014-01-17 15:17	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-01-17 15:17 . 2014-01-17 15:17	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2014-01-17 15:15 . 2014-01-17 15:15	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EC7C59F8-4D50-4A79-BC78-63A83D96923A}\offreg.dll
2014-01-17 13:49 . 2013-12-04 03:28	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EC7C59F8-4D50-4A79-BC78-63A83D96923A}\mpengine.dll
2014-01-16 15:08 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
2014-01-16 15:08 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-01-16 15:08 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-16 15:08 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-16 15:08 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-16 15:08 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-16 15:08 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-16 15:08 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-16 15:08 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-06 16:35 . 2014-01-06 16:35	--------	d-----w-	c:\program files (x86)\Common Files\Java
2014-01-06 16:34 . 2014-01-06 16:34	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-06 16:34 . 2014-01-06 16:34	--------	d-----w-	c:\program files (x86)\Java
2014-01-06 16:01 . 2014-01-06 16:35	--------	d-----w-	c:\programdata\Oracle
2014-01-06 16:01 . 2014-01-06 16:00	312744	----a-w-	c:\windows\system32\javaws.exe
2014-01-06 16:00 . 2014-01-06 16:00	189352	----a-w-	c:\windows\system32\javaw.exe
2014-01-06 16:00 . 2014-01-06 16:00	108968	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2014-01-06 16:00 . 2014-01-06 16:00	189352	----a-w-	c:\windows\system32\java.exe
2014-01-06 16:00 . 2014-01-06 16:00	--------	d-----w-	c:\program files\Java
2013-12-25 02:56 . 2013-12-25 03:29	--------	d-----w-	C:\AdwCleaner
2013-12-25 02:12 . 2013-12-25 02:12	--------	d-----w-	c:\users\Susanne\AppData\Roaming\Malwarebytes
2013-12-25 02:12 . 2013-12-25 02:12	--------	d-----w-	c:\programdata\Malwarebytes
2013-12-25 02:12 . 2013-12-25 02:12	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-12-25 02:12 . 2013-04-04 13:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-12-19 08:32 . 2013-05-10 04:30	167424	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2013-12-19 08:32 . 2013-05-10 03:48	164864	----a-w-	c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-19 08:32 . 2013-05-10 05:56	12625920	----a-w-	c:\windows\system32\wmploc.DLL
2013-12-19 08:32 . 2013-05-10 04:56	12625408	----a-w-	c:\windows\SysWow64\wmploc.DLL
2013-12-19 08:32 . 2013-05-10 05:56	14631424	----a-w-	c:\windows\system32\wmp.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-17 01:06 . 2012-01-10 18:35	86054176	----a-w-	c:\windows\system32\MRT.exe
2013-12-11 13:57 . 2012-10-19 19:47	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 13:57 . 2012-10-19 19:47	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-07 14:24 . 2013-12-07 14:24	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-07 14:24 . 2013-12-07 14:24	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-12-07 14:24 . 2013-12-07 14:24	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2013-12-07 14:24 . 2013-12-07 14:24	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-07 14:24 . 2013-12-07 14:24	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-07 14:24 . 2013-12-07 14:24	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2013-12-07 14:24 . 2013-12-07 14:24	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-12-07 14:24 . 2013-12-07 14:24	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2013-12-07 14:24 . 2013-12-07 14:24	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2013-12-07 14:24 . 2013-12-07 14:24	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2013-12-07 14:24 . 2013-12-07 14:24	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-12-07 14:24 . 2013-12-07 14:24	454656	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-12-07 14:24 . 2013-12-07 14:24	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-12-07 14:24 . 2013-12-07 14:24	34816	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-07 14:24 . 2013-12-07 14:24	337408	----a-w-	c:\windows\SysWow64\html.iec
2013-12-07 14:24 . 2013-12-07 14:24	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-12-07 14:24 . 2013-12-07 14:24	235008	----a-w-	c:\windows\system32\elshyph.dll
2013-12-07 14:24 . 2013-12-07 14:24	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2013-12-07 14:24 . 2013-12-07 14:24	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-12-07 14:24 . 2013-12-07 14:24	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2013-12-07 14:24 . 2013-12-07 14:24	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2013-12-07 14:24 . 2013-12-07 14:24	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-12-07 14:24 . 2013-12-07 14:24	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-12-07 14:24 . 2013-12-07 14:24	1051136	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-12-07 14:24 . 2013-12-07 14:24	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-12-07 14:24 . 2013-12-07 14:24	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-12-07 14:24 . 2013-12-07 14:24	247808	----a-w-	c:\windows\system32\msls31.dll
2013-12-07 14:24 . 2013-12-07 14:24	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-12-07 14:24 . 2013-12-07 14:24	84992	----a-w-	c:\windows\system32\mshtmled.dll
2013-12-07 14:24 . 2013-12-07 14:24	81408	----a-w-	c:\windows\system32\icardie.dll
2013-12-07 14:24 . 2013-12-07 14:24	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-12-07 14:24 . 2013-12-07 14:24	626176	----a-w-	c:\windows\system32\msfeeds.dll
2013-12-07 14:24 . 2013-12-07 14:24	62464	----a-w-	c:\windows\system32\pngfilt.dll
2013-12-07 14:24 . 2013-12-07 14:24	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2013-12-07 14:24 . 2013-12-07 14:24	548352	----a-w-	c:\windows\system32\vbscript.dll
2013-12-07 14:24 . 2013-12-07 14:24	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-12-07 14:24 . 2013-12-07 14:24	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-12-07 14:24 . 2013-12-07 14:24	453120	----a-w-	c:\windows\system32\dxtmsft.dll
2013-12-07 14:24 . 2013-12-07 14:24	413696	----a-w-	c:\windows\system32\html.iec
2013-12-07 14:24 . 2013-12-07 14:24	40448	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-07 14:24 . 2013-12-07 14:24	30208	----a-w-	c:\windows\system32\licmgr10.dll
2013-12-07 14:24 . 2013-12-07 14:24	296960	----a-w-	c:\windows\system32\dxtrans.dll
2013-12-07 14:24 . 2013-12-07 14:24	263376	----a-w-	c:\windows\system32\iedkcs32.dll
2013-12-07 14:24 . 2013-12-07 14:24	243200	----a-w-	c:\windows\system32\webcheck.dll
2013-12-07 14:24 . 2013-12-07 14:24	235520	----a-w-	c:\windows\system32\url.dll
2013-12-07 14:24 . 2013-12-07 14:24	195584	----a-w-	c:\windows\system32\msrating.dll
2013-12-07 14:24 . 2013-12-07 14:24	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-12-07 14:24 . 2013-12-07 14:24	147968	----a-w-	c:\windows\system32\occache.dll
2013-12-07 14:24 . 2013-12-07 14:24	143872	----a-w-	c:\windows\system32\wextract.exe
2013-12-07 14:24 . 2013-12-07 14:24	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2013-12-07 14:24 . 2013-12-07 14:24	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-12-07 14:24 . 2013-12-07 14:24	1228800	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-12-07 14:24 . 2013-12-07 14:24	105984	----a-w-	c:\windows\system32\iesysprep.dll
2013-12-07 14:24 . 2013-12-07 14:24	101376	----a-w-	c:\windows\system32\inseng.dll
2013-12-07 14:24 . 2013-12-07 14:24	13824	----a-w-	c:\windows\system32\mshta.exe
2013-12-07 14:24 . 2013-12-07 14:24	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2013-12-07 14:24 . 2013-12-07 14:24	774144	----a-w-	c:\windows\system32\jscript.dll
2013-12-07 14:24 . 2013-12-07 14:24	48128	----a-w-	c:\windows\system32\imgutil.dll
2013-12-07 14:24 . 2013-12-07 14:24	135680	----a-w-	c:\windows\system32\iepeers.dll
2013-11-26 11:25 . 2010-11-21 03:27	267936	------w-	c:\windows\system32\MpSigStub.exe
2013-11-23 18:26 . 2013-12-14 12:56	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-14 12:56	465920	----a-w-	c:\windows\system32\WMPhoto.dll
2013-11-12 02:23 . 2013-12-14 12:56	2048	----a-w-	c:\windows\system32\tzres.dll
2013-11-12 02:07 . 2013-12-14 12:56	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2013-10-30 02:32 . 2013-12-14 12:56	335360	----a-w-	c:\windows\system32\msieftp.dll
2013-10-30 02:19 . 2013-12-14 12:56	301568	----a-w-	c:\windows\SysWow64\msieftp.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ControlCenter4"="c:\program files (x86)\ControlCenter4\BrCcBoot.exe" [2011-04-20 139264]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
"G Data AntiVirus Tray"="c:\program files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe" [2013-03-22 1444304]
"GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2013-03-22 1854928]
"G Data ASM"="c:\program files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe" [2013-02-25 472016]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 dc3d;Microsoft-Hardware – Geräteerkennungstreiber;c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys;c:\windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys;c:\windows\SYSNATIVE\drivers\GDBehave.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys;c:\windows\SYSNATIVE\drivers\MiniIcpt.sys [x]
S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys;c:\windows\SYSNATIVE\drivers\gdwfpcd64.sys [x]
S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys;c:\windows\SYSNATIVE\drivers\GRD.sys [x]
S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys;c:\windows\SYSNATIVE\drivers\HookCentre.sys [x]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x]
S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [x]
S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [x]
S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [x]
S3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
S3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [x]
S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys;c:\windows\SYSNATIVE\drivers\PktIcpt.sys [x]
S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 SiSGbeLH;NDIS 6.0-Treiber für SiS191/SiS190-Ethernet-Gerät;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-19 13:57]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 16330272]
"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-10-12 1464984]
"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-10-12 2075288]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.at/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: Interfaces\{B8A9105E-F11D-4AE4-92E1-C9FC0C359C72}: NameServer = 10.0.0.138,195.3.96.67
FF - ProfilePath - c:\users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\qkhwuboy.default\
FF - prefs.js: browser.startup.homepage - hxxp://kurier.at/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Adobe Photoshop 7.0 - c:\windows\ISUN0407.EXE
.
.
.

Teil 2 kommt in der nächsten Antwort.

Hab ich noch weiteren Handlungsbedarf? Diese Files sind immer noch am Rechner:

Infizierte Dateien: 3
C:\Windows\Setup\Scripts\Windows7Loader.exe (Trojan.Agent.W) -> Keine Aktion durchgeführt.
D:\Mozilla Firefox Downloads\TinyPicSetup.exe (Backdoor.Agent.FPA) -> Keine Aktion durchgeführt.
D:\_für neues Notebook\sonst von C alter PC\C\Eigene Dateien\Downloads\TinyPicSetup.exe (Backdoor.Agent.FPA) -> Keine Aktion durchgeführt.

Danke und Gruß!

912946 · 17.01.2014, 17:46

Teil 2:
es geht sich auch auf 2x nicht aus, hab daher das gesamt Logfile als pdf in den Anhang verpackt.
Gruß, Susanne

schrauber · 18.01.2014, 08:07

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

912946 · 19.01.2014, 12:39

Hausaufgaben gemacht, jetzt gehts ab in den Urlaub!
Hier sind die Logfiles, sieht alles sehr unbedenklich aus. Hoffe, du bist auch dieser Meinung!

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.19.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Susanne :: ASUS-NOTEBOOK [Administrator]

19.01.2014 10:55:51
mbam-log-2014-01-19 (10-55-51).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 237148
Laufzeit: 7 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

ATTFilter

# AdwCleaner v3.017 - Bericht erstellt am 19/01/2014 um 11:38:55
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Susanne - ASUS-NOTEBOOK
# Gestartet von : C:\Users\Susanne\Desktop\adwcleaner(1).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\FLEXnet

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\qkhwuboy.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [3037 octets] - [25/12/2013 03:56:36]
AdwCleaner[R1].txt - [1027 octets] - [19/01/2014 11:21:03]
AdwCleaner[S0].txt - [3006 octets] - [25/12/2013 04:29:35]
AdwCleaner[S1].txt - [900 octets] - [19/01/2014 11:38:55]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [959 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Ultimate x64
Ran by Susanne on 19.01.2014 at 11:53:02,49
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Users\Susanne\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\driverscanner.lnk"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uniblue"



~~~ FireFox

Emptied folder: C:\Users\Susanne\AppData\Roaming\mozilla\firefox\profiles\qkhwuboy.default\minidumps [40 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.01.2014 at 12:05:59,38
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 03
Ran by Susanne (administrator) on ASUS-NOTEBOOK on 19-01-2014 12:13:07
Running from C:\Users\Susanne\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Farbar) C:\Users\Susanne\Desktop\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [16330272 2009-07-02] (NVIDIA Corporation)
HKLM\...\Run: [IntelliType Pro] - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464984 2012-10-12] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2075288 2012-10-12] (Microsoft Corporation)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444472 2013-08-21] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] - C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [472016 2013-02-25] (G Data Software AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844168 2013-06-10] (Samsung)
HKU\Administrator\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-04-23] (Samsung)
HKU\Administrator\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2013-04-18] (Samsung Electronics)
HKU\Administrator\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844168 2013-06-10] (Samsung)
HKU\Administrator\...\Run: [DriverScanner] - "C:\Program Files (x86)\Uniblue\DriverScanner\launcher.exe" delay 20000 
HKU\Administrator\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7FEC8C782FAECD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Tcpip\..\Interfaces\{B8A9105E-F11D-4AE4-92E1-C9FC0C359C72}: [NameServer]10.0.0.138,195.3.96.67

FireFox:
========
FF ProfilePath: C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\qkhwuboy.default
FF Homepage: hxxp://kurier.at/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Susanne\AppData\Roaming\Mozilla\Firefox\Profiles\qkhwuboy.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-30]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2014-01-06]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2014-01-06]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-12-20]

==================== Services (Whitelisted) =================

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1970296 2013-08-26] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635000 2013-08-21] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2562208 2013-10-15] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2942808 2013-10-17] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [695416 2013-08-22] (G Data Software AG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

==================== Drivers (Whitelisted) ====================

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-04-18] ()
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2014-01-19] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [130392 2014-01-19] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [63320 2014-01-19] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2014-01-19] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-08-13] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65368 2014-01-19] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATK64AMD.sys [13680 2007-08-09] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-19 12:13 - 2014-01-19 12:13 - 00013700 _____ C:\Users\Susanne\Desktop\FRST.txt
2014-01-19 11:52 - 2014-01-19 11:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 11:52 - 2014-01-19 11:51 - 01037068 _____ (Thisisu) C:\Users\Susanne\Desktop\JRT.exe
2014-01-19 11:19 - 2014-01-19 11:18 - 01236282 _____ C:\Users\Susanne\Desktop\adwcleaner(1).exe
2014-01-19 10:53 - 2014-01-19 10:53 - 00001118 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-19 10:53 - 2014-01-19 10:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-19 10:53 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-17 16:20 - 2014-01-17 16:20 - 00152010 _____ C:\ComboFix.txt
2014-01-17 15:11 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-17 15:11 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-17 15:11 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-17 15:11 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-17 15:11 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-17 15:11 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-17 15:11 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-17 15:11 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-17 15:00 - 2014-01-17 16:20 - 00000000 ____D C:\Qoobox
2014-01-17 14:55 - 2014-01-17 16:18 - 00000000 ____D C:\Windows\erdnt
2014-01-17 14:53 - 2014-01-17 14:50 - 05167985 ____R (Swearware) C:\Users\Susanne\Desktop\ComboFix.exe
2014-01-16 21:35 - 2014-01-16 21:33 - 02076160 _____ (Farbar) C:\Users\Susanne\Desktop\FRST64(1).exe
2014-01-16 16:08 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-16 16:08 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-16 16:08 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-16 16:08 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-16 16:08 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-16 16:08 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-16 16:08 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-16 16:08 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-16 16:08 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-06 17:35 - 2014-01-06 17:35 - 00000000 ____D C:\ProgramData\Sun
2014-01-06 17:34 - 2014-01-06 17:34 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-06 17:34 - 2014-01-06 17:34 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-06 17:32 - 2014-01-06 17:32 - 00915368 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\JavaSetup7u45.com
2014-01-06 17:01 - 2014-01-06 17:35 - 00000000 ____D C:\ProgramData\Oracle
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung.lnk
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung (2).lnk
2014-01-06 17:01 - 2014-01-06 17:00 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-06 17:00 - 2014-01-06 17:00 - 00000000 ____D C:\Program Files\Java
2014-01-06 16:58 - 2014-01-06 16:59 - 30694824 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\jre-7u45-windows-x64.com
2014-01-06 16:33 - 2014-01-06 16:33 - 00001247 _____ C:\Windows\IE9_main.log
2014-01-06 16:28 - 2014-01-06 16:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-25 03:56 - 2014-01-19 11:39 - 00000000 ____D C:\AdwCleaner
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Malwarebytes
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\ProgramData\Malwarebytes

==================== One Month Modified Files and Folders =======

2014-01-19 12:13 - 2014-01-19 12:13 - 00013700 _____ C:\Users\Susanne\Desktop\FRST.txt
2014-01-19 12:12 - 2012-10-23 22:54 - 00000000 ___RD C:\Users\Susanne\Desktop\PC Aufräumen
2014-01-19 11:57 - 2013-09-18 08:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-19 11:52 - 2014-01-19 11:52 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 11:51 - 2014-01-19 11:52 - 01037068 _____ (Thisisu) C:\Users\Susanne\Desktop\JRT.exe
2014-01-19 11:47 - 2009-07-14 05:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-19 11:47 - 2009-07-14 05:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-19 11:40 - 2013-10-09 09:43 - 00003037 _____ C:\Windows\setupact.log
2014-01-19 11:40 - 2013-10-06 14:49 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2014-01-19 11:40 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-19 11:39 - 2013-12-25 03:56 - 00000000 ____D C:\AdwCleaner
2014-01-19 11:39 - 2012-10-19 19:02 - 01842601 _____ C:\Windows\WindowsUpdate.log
2014-01-19 11:39 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\tracing
2014-01-19 11:18 - 2014-01-19 11:19 - 01236282 _____ C:\Users\Susanne\Desktop\adwcleaner(1).exe
2014-01-19 10:53 - 2014-01-19 10:53 - 00001118 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-19 10:53 - 2014-01-19 10:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-19 09:43 - 2013-08-12 12:36 - 00063320 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-01-19 09:43 - 2013-08-12 12:36 - 00001987 _____ C:\Users\Public\Desktop\G Data InternetSecurity 2014.lnk
2014-01-19 09:43 - 2013-08-12 12:35 - 00065368 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-01-19 09:42 - 2013-08-12 12:35 - 00130392 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-01-19 09:42 - 2013-08-12 12:35 - 00064856 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-01-19 09:42 - 2013-08-12 12:35 - 00060248 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-01-19 08:23 - 2013-10-09 09:43 - 00003292 _____ C:\Windows\PFRO.log
2014-01-17 16:20 - 2014-01-17 16:20 - 00152010 _____ C:\ComboFix.txt
2014-01-17 16:20 - 2014-01-17 15:00 - 00000000 ____D C:\Qoobox
2014-01-17 16:20 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-17 16:18 - 2014-01-17 14:55 - 00000000 ____D C:\Windows\erdnt
2014-01-17 16:17 - 2009-07-14 03:34 - 00000248 _____ C:\Windows\system.ini
2014-01-17 14:50 - 2014-01-17 14:53 - 05167985 ____R (Swearware) C:\Users\Susanne\Desktop\ComboFix.exe
2014-01-17 14:40 - 2009-07-14 05:45 - 00428152 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-17 02:10 - 2012-10-19 22:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-17 02:09 - 2013-08-15 00:55 - 00000000 ____D C:\Windows\system32\MRT
2014-01-17 02:06 - 2012-01-10 19:35 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 21:33 - 2014-01-16 21:35 - 02076160 _____ (Farbar) C:\Users\Susanne\Desktop\FRST64(1).exe
2014-01-16 15:56 - 2012-10-19 20:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-06 18:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2014-01-06 17:35 - 2014-01-06 17:35 - 00000000 ____D C:\ProgramData\Sun
2014-01-06 17:35 - 2014-01-06 17:01 - 00000000 ____D C:\ProgramData\Oracle
2014-01-06 17:34 - 2014-01-06 17:34 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-06 17:34 - 2014-01-06 17:34 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-06 17:34 - 2014-01-06 17:34 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-06 17:32 - 2014-01-06 17:32 - 00915368 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\JavaSetup7u45.com
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung.lnk
2014-01-06 17:01 - 2014-01-06 17:01 - 00001530 _____ C:\Users\Susanne\Desktop\iexplore.exe - Verknüpfung (2).lnk
2014-01-06 17:00 - 2014-01-06 17:01 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-06 17:00 - 2014-01-06 17:00 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-06 17:00 - 2014-01-06 17:00 - 00000000 ____D C:\Program Files\Java
2014-01-06 16:59 - 2014-01-06 16:58 - 30694824 _____ (Oracle Corporation) C:\Users\Susanne\Downloads\jre-7u45-windows-x64.com
2014-01-06 16:33 - 2014-01-06 16:33 - 00001247 _____ C:\Windows\IE9_main.log
2014-01-06 16:29 - 2014-01-06 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-25 05:02 - 2011-04-12 08:43 - 00657910 _____ C:\Windows\system32\perfh007.dat
2013-12-25 05:02 - 2011-04-12 08:43 - 00131250 _____ C:\Windows\system32\perfc007.dat
2013-12-25 05:02 - 2009-07-14 06:13 - 01507342 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-25 04:29 - 2013-08-15 00:50 - 00000000 ____D C:\ProgramData\Uniblue
2013-12-25 04:29 - 2012-12-31 15:29 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Uniblue
2013-12-25 04:29 - 2012-12-31 15:29 - 00000000 ____D C:\Program Files (x86)\Uniblue
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\Users\Susanne\AppData\Roaming\Malwarebytes
2013-12-25 03:12 - 2013-12-25 03:12 - 00000000 ____D C:\ProgramData\Malwarebytes

Some content of TEMP:
====================
C:\Users\Susanne\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 10:14

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 20.01.2014, 09:55

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Backdoor- und Trojan-Agents mit MalwareBytes entdeckt

Log-Analyse und Auswertung: Backdoor- und Trojan-Agents mit MalwareBytes entdeckt