| |
| |||||||
Log-Analyse und Auswertung: buzzsearch, medfos, nextlive, isafeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
14.02.2014, 22:17
| #1 |
| |  buzzsearch, medfos, nextlive, isafe Nach Ausführung von adwcleaner und JRT ist leider noch Malware auf dem befallenen System. Nach empfohlener Vorgehensweise mit defogger, FRST und GMER würde ich mich über Tipps zum weiteren Vorgehen freuen. Logs: JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by leventselin on 14.02.2014 at 21:05:10,83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
Failed to stop: [Service] update buzzsearch
Failed to stop: [Service] util buzzsearch
~~~ Registry Values
Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B?
Value Name Type Value Data
========================================================================================
NextLive REG_SZ C:\Windows\system32\rundll32.exe "C:\Users\leventselin\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\leventselin\AppData\Roaming\isafe"
Failed to delete: [Folder] "C:\Program Files\buzzsearch"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.02.2014 at 21:09:02,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by leventselin (administrator) on LEVENTSELIN-PC on 14-02-2014 21:15:32
Running from C:\Users\leventselin\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor Corp.) C:\Users\leventselin\AppData\Local\Temp\RtkBtMnt.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
() C:\Program Files\BuzzSearch\updateBuzzSearch.exe
() C:\Program Files\BuzzSearch\bin\utilBuzzSearch.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Users\leventselin\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ArcadeDeluxeAgent] - C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [156968 2009-01-21] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] - C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [202024 2009-01-21] (CyberLink)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-06-02] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6793760 2009-02-19] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2009-07-25] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.)
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1069576 2009-06-25] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-07-18] (Google)
HKLM\...\Run: [avast5] - C:\Program Files\Alwil Software\Avast5\AvastUI.exe [2654512 2009-11-30] (ALWIL Software)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [mobilegeni daemon] - C:\Program Files\Mobogenie\DaemonProcess.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [HP Officejet 4620 series (NET)] - C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2009-09-25] (Google Inc.)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [NextLive] - C:\Windows\system32\rundll32.exe "C:\Users\leventselin\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\MountPoints2: E - E:\Startme.exe
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\MountPoints2: {de80fdd9-74ef-11e0-ba2a-001f16b73885} - E:\Startme.exe
Startup: C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop_01031103.lnk
ShortcutTarget: lollipop_01031103.lnk -> C:\Users\leventselin\AppData\Local\Lollipop\lollipop_01031103.exe (No File)
Startup: C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x209D56E0FE40CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com.tr/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE346DE346
SearchScopes: HKCU - {96AEF64D-9E1E-4F83-9964-2B721427C3A0} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {A00E8FBF-6496-4412-B6DA-5BE71196B00E} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {B919971D-9DEC-4C69-89A0-3757257566A3} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F91BE375-4164-4484-99E2-EEEC62D609B0} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: No Name - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - No File
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No File
BHO: No Name - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - No File
Toolbar: HKLM - No Name - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll No File
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 36 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\leventselin\AppData\Roaming\Mozilla\Firefox\Profiles\t7xl4zj4.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll No File
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll No File
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll No File
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll No File
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll No File
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
Chrome:
=======
CHR HomePage: hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
CHR RestoreOnStartup: "hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874"
CHR DefaultSearchKeyword: nationzoom
CHR DefaultSearchProvider: nationzoom
CHR DefaultSearchURL: hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
CHR Extension: (Widget context) - C:\Users\leventselin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-08]
CHR HKLM\...\Chrome\Extension: [jhjjdgbhohaallcimgcmakfiobacimkm] - C:\Program Files\BuzzSearch\jhjjdgbhohaallcimgcmakfiobacimkm.crx [2014-01-08]
CHR HKLM\...\Chrome\Extension: [lkemddiljapcmhicklfpcbpfffahfbja] - C:\Users\leventselin\AppData\Local\Google\Chrome\User Data\Default\extensions\WebNavigation.crx [2012-12-13]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2009-11-30] (ALWIL Software)
R3 avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2009-11-30] (ALWIL Software)
S3 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-07-18] (Google)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
R2 Update BuzzSearch; C:\Program Files\BuzzSearch\updateBuzzSearch.exe [80672 2014-02-13] ()
R2 Util BuzzSearch; C:\Program Files\BuzzSearch\bin\utilBuzzSearch.exe [80672 2014-02-13] ()
==================== Drivers (Whitelisted) ====================
R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.)
R2 aswFsBlk; C:\Windows\system32\Drivers\aswFsBlk.sys [19024 2009-11-30] (ALWIL Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [51792 2009-11-30] (ALWIL Software)
R1 aswRdr; C:\Windows\system32\Drivers\aswRdr.sys [23248 2009-11-30] (ALWIL Software)
R1 aswSP; C:\Windows\system32\Drivers\aswSP.sys [149840 2009-11-30] (ALWIL Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [46544 2009-11-30] (ALWIL Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 DCamUSBEMPIA; C:\Windows\System32\DRIVERS\emDevice.sys [171136 2007-06-21] (eMPIA Technology, Inc.)
S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [24448 2007-10-26] (eMPIA Technology, Inc.)
S3 FiltUSBEMPIA; C:\Windows\System32\DRIVERS\emFilter.sys [5248 2007-06-21] (eMPIA Technology, Inc.)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [154272 2008-11-12] (Realtek Semiconductor Corp.)
S3 ScanUSBEMPIA; C:\Windows\System32\DRIVERS\emScan.sys [5120 2007-06-21] (eMPIA Technology, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-16] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [87536 2008-12-26] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 iSafeNetFilter; \??\C:\Program Files\iSafe\iSafeNetFilter.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-14 21:15 - 2014-02-14 21:15 - 00020226 _____ () C:\Users\leventselin\Desktop\FRST.txt
2014-02-14 21:15 - 2014-02-14 21:15 - 00000000 ____D () C:\FRST
2014-02-14 21:14 - 2014-02-14 21:14 - 01141248 _____ (Farbar) C:\Users\leventselin\Desktop\FRST.exe
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setupact.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000484 _____ () C:\Users\leventselin\Desktop\defogger_disable.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000000 _____ () C:\Users\leventselin\defogger_reenable
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe
2014-02-14 21:09 - 2014-02-14 21:09 - 00001474 _____ () C:\Users\leventselin\Desktop\JRT.txt
2014-02-14 20:57 - 2014-02-14 20:57 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-14 20:57 - 2014-02-14 20:57 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-14 20:47 - 2014-02-14 20:47 - 00014378 _____ () C:\Windows\PFRO.log
2014-02-14 12:10 - 2014-02-14 12:10 - 01037530 _____ (Thisisu) C:\Users\leventselin\Desktop\JRT.exe
2014-02-14 12:10 - 2014-02-14 12:10 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 12:02 - 2014-02-14 21:00 - 00000000 ____D () C:\AdwCleaner
2014-02-14 12:01 - 2014-02-14 12:01 - 01166132 _____ () C:\Users\leventselin\Desktop\adwcleaner.exe
2014-02-14 10:43 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 10:43 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 10:43 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 10:43 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 10:43 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 10:43 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 10:43 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 10:43 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 10:43 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 10:43 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 10:43 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-14 10:43 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 00:56 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\eCyber
2014-01-30 00:47 - 2014-01-30 00:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-01-24 12:49 - 2014-01-24 12:49 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-01-24 12:49 - 2014-01-24 12:49 - 00000000 ____D () C:\ProgramData\Oracle
==================== One Month Modified Files and Folders =======
2014-02-14 21:15 - 2014-02-14 21:15 - 00020226 _____ () C:\Users\leventselin\Desktop\FRST.txt
2014-02-14 21:15 - 2014-02-14 21:15 - 00000000 ____D () C:\FRST
2014-02-14 21:14 - 2014-02-14 21:14 - 01141248 _____ (Farbar) C:\Users\leventselin\Desktop\FRST.exe
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setupact.log
2014-02-14 21:14 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-14 21:14 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-14 21:13 - 2014-02-14 21:13 - 00000484 _____ () C:\Users\leventselin\Desktop\defogger_disable.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000000 _____ () C:\Users\leventselin\defogger_reenable
2014-02-14 21:13 - 2009-09-25 16:50 - 00000000 ____D () C:\Users\leventselin
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe
2014-02-14 21:09 - 2014-02-14 21:09 - 00001474 _____ () C:\Users\leventselin\Desktop\JRT.txt
2014-02-14 21:07 - 2011-11-01 20:06 - 01356469 _____ () C:\Windows\WindowsUpdate.log
2014-02-14 21:06 - 2013-11-20 21:21 - 00000000 ____D () C:\Program Files\BuzzSearch
2014-02-14 21:04 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\newnext.me
2014-02-14 21:02 - 2009-12-11 21:20 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-14 21:02 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-14 21:01 - 2006-11-02 14:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-14 21:00 - 2014-02-14 12:02 - 00000000 ____D () C:\AdwCleaner
2014-02-14 20:58 - 2009-10-25 11:56 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Mozilla
2014-02-14 20:57 - 2014-02-14 20:57 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-14 20:57 - 2014-02-14 20:57 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-14 20:57 - 2014-01-02 22:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-14 20:53 - 2012-04-22 21:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-14 20:47 - 2014-02-14 20:47 - 00014378 _____ () C:\Windows\PFRO.log
2014-02-14 20:43 - 2011-05-26 13:14 - 00000000 ____D () C:\Program Files\Samsung
2014-02-14 20:42 - 2009-02-11 21:16 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-02-14 20:39 - 2014-01-02 22:03 - 00000000 ____D () C:\ProgramData\WPM
2014-02-14 20:37 - 2011-09-15 18:15 - 00000000 ____D () C:\ProgramData\Norton
2014-02-14 20:35 - 2014-01-02 21:35 - 00000000 ____D () C:\Users\leventselin\AppData\Local\Mobogenie
2014-02-14 20:33 - 2011-05-26 13:16 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Samsung
2014-02-14 20:33 - 2011-05-26 13:16 - 00000000 ____D () C:\Program Files\PC Connectivity Solution
2014-02-14 20:15 - 2012-12-13 14:38 - 00000000 ____D () C:\ProgramData\Zbshareware Lab
2014-02-14 20:13 - 2009-03-12 03:59 - 00000000 ____D () C:\Program Files\Acer GameZone
2014-02-14 19:47 - 2009-12-11 21:20 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-14 14:43 - 2011-01-22 22:32 - 00001022 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-02-14 12:30 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-14 12:11 - 2014-01-02 21:35 - 00008713 _____ () C:\Users\leventselin\daemonprocess.txt
2014-02-14 12:10 - 2014-02-14 12:10 - 01037530 _____ (Thisisu) C:\Users\leventselin\Desktop\JRT.exe
2014-02-14 12:10 - 2014-02-14 12:10 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 12:04 - 2009-10-25 11:56 - 00000000 ____D () C:\ProgramData\ICQ
2014-02-14 12:01 - 2014-02-14 12:01 - 01166132 _____ () C:\Users\leventselin\Desktop\adwcleaner.exe
2014-02-14 11:03 - 2006-11-02 11:33 - 01469650 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-14 10:59 - 2013-08-15 14:56 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 10:53 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-13 22:39 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Local\cache
2014-02-13 22:38 - 2014-01-02 21:35 - 00000000 ____D () C:\Users\leventselin\AppData\Local\genienext
2014-02-13 22:27 - 2012-04-22 21:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-13 22:27 - 2011-09-16 13:48 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-13 22:25 - 2009-12-03 22:04 - 00000000 ____D () C:\Users\leventselin\AppData\Local\Adobe
2014-02-10 19:31 - 2012-10-21 14:32 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 19:30 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\eCyber
2014-02-10 18:55 - 2009-09-29 13:13 - 00000000 ____D () C:\Users\leventselin\Tracing
2014-02-09 21:58 - 2009-10-05 14:52 - 00007160 _____ () C:\Users\leventselin\AppData\Local\d3d9caps.dat
2014-02-05 09:58 - 2014-02-14 10:43 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-14 10:43 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-14 10:43 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-14 10:43 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-14 10:43 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-14 10:43 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-14 10:43 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-14 10:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-14 10:43 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-14 10:43 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-14 10:43 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-14 10:43 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-01-30 00:47 - 2014-01-30 00:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-01-30 00:46 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-01-24 12:49 - 2014-01-24 12:49 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-01-24 12:49 - 2014-01-24 12:49 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-24 12:49 - 2009-09-29 11:56 - 00000000 ____D () C:\Program Files\Java
2014-01-16 22:44 - 2009-03-12 04:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
Files to move or delete:
====================
C:\Users\leventselin\SkypeSetupFull.exe
C:\Users\Public\AlexaNSISPlugin.4744.dll
Some content of TEMP:
====================
C:\Users\leventselin\AppData\Local\Temp\avgnt.exe
C:\Users\leventselin\AppData\Local\Temp\Quarantine.exe
C:\Users\leventselin\AppData\Local\Temp\RtkBtMnt.exe
C:\Users\leventselin\AppData\Local\Temp\SPSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-14 21:08
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2014 01
Ran by leventselin at 2014-02-14 21:15:55
Running from C:\Users\leventselin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Out of date) {C37D8F93-0602-E43C-40AA-47DAD597F308}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: avast! Antivirus (Enabled - Out of date) {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (Version: - Microsoft)
Acer Arcade Deluxe (Version: 2.5.6121 - CyberLink Corp.)
Acer Arcade Deluxe (Version: 2.5.6121 - CyberLink Corp.) Hidden
Acer Backup Manager (Version: 1.0.0.58 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.74.216 (Version: 1.1.74.216 - Chicony Electronics Co.,Ltd.)
Acer eRecovery Management (Version: 4.00.3008 - Acer Incorporated)
Acer GridVista (Version: 2.72.317 - )
Acer PowerSmart Manager (Version: 4.01.3016 - Acer Incorporated)
Acer Product Registration (Version: 3.0.0.10 - Acer Incorporated)
Acer ScreenSaver (Version: 1.0.0.0226 - Acer)
Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8 - Adobe Systems Incorporated)
Airport Mania First Flight (Version: - Oberon Media)
Amazon Browser Settings (Version: 3.0 - Amazon)
Apple Application Support (Version: 2.2.2 - Apple Inc.)
Apple Mobile Device Support (Version: 6.0.0.59 - Apple Inc.)
Apple Software Update (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (Version: 3.0.728.0 - ATI Technologies, Inc.)
avast! Free Antivirus (Version: 5.0.259.0 - Alwil Software)
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Backup Manager Basic (Version: 1.0.0.58 - NewTech Infosystems) Hidden
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Broadcom Gigabit NetLink Controller (Version: 11.34.02 - Broadcom Corporation)
C:\Program Files\Acer GameZone\GameConsole (Version: 2.0.1.6 - Oberon Media, Inc.)
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Full New (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Light (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Localization All (Version: 2009.0602.2224.38408 - ATI) Hidden
CCC Help Chinese Standard (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Czech (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Danish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Dutch (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help English (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Finnish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help French (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help German (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Greek (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Hungarian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Italian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Japanese (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Korean (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Norwegian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Polish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Portuguese (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Russian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Spanish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Swedish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Thai (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Turkish (Version: 2009.0602.2223.38408 - ATI) Hidden
ccc-core-static (Version: 2009.0602.2224.38408 - Ihr Firmenname) Hidden
ccc-utility (Version: 2009.0602.2224.38408 - ATI) Hidden
CCleaner (Version: 2.32 - Piriform)
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000 - Microsoft Corporation)
Cooking Dash (Version: - Oberon Media)
Cradle of Rome (Version: - Oberon Media)
CVE-2012-4969 (Version: - )
Dairy Dash (Version: - Oberon Media)
eSobi v2 (Version: 2.0.3.000223 - esobi Inc.)
eSobi v2 (Version: 2.0.3.000223 - esobi Inc.) Hidden
Galapago (Version: - Oberon Media)
Google Apps (Version: 1.2.279.2381 - Google Inc.)
Google Chrome (Version: 32.0.1700.107 - Google Inc.)
Google Desktop (Version: 5.9.1005.12335 - Google)
Google Earth (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
Google Updater (Version: 2.4.2432.1652 - Google Inc.)
HDAUDIO Soft Data Fax Modem with SmartCP (Version: 7.80.2.53 - Conexant Systems)
HP Officejet 4620 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (Version: 6.0.0 - Hewlett Packard)
HP Photo Creations (Version: 1.0.0.9572 - HP)
HP Update (Version: 5.003.003.001 - Hewlett-Packard)
I.R.I.S. OCR (Version: 12.3.4.0 - HP)
iTunes (Version: 10.7.0.21 - Apple Inc.)
Jewel Quest Solitaire (Version: - Oberon Media)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Launch Manager (Version: 2.0.10 - Acer Inc.)
Luxor 2 (Version: - Oberon Media)
Mahjong Escape Ancient China (Version: - Oberon Media)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (Version: 27.0.1 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
NTI Backup Now 5 (Version: 5.1.2.616 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.616 - NewTech Infosystems) Hidden
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems) Hidden
Ocean Express (Version: - Oberon Media)
Orion (Version: 2.5.0 - Convesoft)
Parking Dash (Version: - Oberon Media)
PC Connectivity Solution (Version: 8.15.0.0 - Nokia)
Picasa 3 (Version: 3.9 - Google, Inc.)
Playway 3 Rainbow Edition - Lernsoftware zum Arbeitsheft (Version: 1.00.0000 - Ernst Klett Grundschulverlag GmbH)
Puzzle Express (Version: - Oberon Media)
QuickTime (Version: 7.72.80.56 - Apple Inc.)
Realtek High Definition Audio Driver (Version: 6.0.1.5794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (Version: 6.0.6000.20113 - Realtek Semiconductor Corp.)
Skins (Version: 2009.0602.2224.38408 - ATI) Hidden
Studie zur Verbesserung von HP Officejet 4620 series Produkten (Version: 28.0.1315.0 - Hewlett-Packard Co.)
SweetIM for Messenger 2.8 (Version: 2.8.0012 - SweetIM Technologies Ltd.) <==== ATTENTION
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (Version: 12.1.0.0 - Synaptics)
Tradewinds 2 (Version: - Oberon Media)
Update for 2007 Microsoft Office System (KB967642) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (Version: - Microsoft)
WAS IST WAS - Wissen von A-Z (Version: - )
Windows Live Call (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8118.427 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (Version: 10/12/2007 6.85.4.0 - Nokia)
WinRAR 4.20 (32-Bit) (Version: 4.20.0 - win.rar GmbH)
==================== Restore Points =========================
11-12-2013 11:24:23 Windows Update
11-12-2013 23:52:42 Geplanter Prüfpunkt
14-12-2013 01:14:07 Geplanter Prüfpunkt
15-12-2013 19:45:17 Geplanter Prüfpunkt
19-12-2013 13:03:33 Geplanter Prüfpunkt
21-12-2013 00:17:39 Geplanter Prüfpunkt
24-12-2013 20:05:51 Geplanter Prüfpunkt
26-12-2013 22:02:32 Geplanter Prüfpunkt
28-12-2013 20:39:16 Geplanter Prüfpunkt
29-12-2013 12:01:20 Windows Update
30-12-2013 01:21:53 Removed Bing Bar
30-12-2013 01:28:53 Microsoft Works wird entfernt
30-12-2013 01:31:43 Windows Live ID-Anmelde-Assistent wird entfernt
30-12-2013 01:32:36 Removed Skype™ 6.1
30-12-2013 20:38:09 Windows Update
02-01-2014 13:16:38 Geplanter Prüfpunkt
05-01-2014 12:26:15 Windows Update
16-01-2014 21:21:56 Windows Update
19-01-2014 21:43:22 Windows Update
24-01-2014 11:47:15 Installed Java 7 Update 51
31-01-2014 01:07:03 Geplanter Prüfpunkt
02-02-2014 02:51:12 Geplanter Prüfpunkt
05-02-2014 13:25:06 Geplanter Prüfpunkt
12-02-2014 10:52:00 Windows Update
14-02-2014 09:42:13 Windows Update
14-02-2014 19:05:28 TuneUp Utilities 2009 wird entfernt
14-02-2014 19:15:53 Removed SweetIM Toolbar for Internet Explorer 3.6
14-02-2014 19:16:23 Removed SweetIM for Messenger 2.8
14-02-2014 19:31:20 Entfernt Samsung New PC Studio
14-02-2014 19:38:00 Removed Shopop
14-02-2014 19:42:23 Entfernt Samsung New PC Studio USB Driver Installer
14-02-2014 19:43:05 SamsungConnectivityCableDriver wird entfernt
14-02-2014 19:44:42 Konfiguriert USB Video/Audio Driver
==================== Hosts content: ==========================
2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {190B42EA-EBD0-4938-95BD-EA953E34521B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-11] (Google Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {6286A21F-42DB-4C26-AD1E-F51CE7E55A67} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-11] (Google Inc.)
Task: {63B37A96-3CE3-4CC9-B73F-95BAEC4ECD15} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {843D5E54-A220-44CB-A1E7-B18ED7CE416C} - System32\Tasks\Java Update Scheduler => C:\Program Files\Java\jre6\bin\jusched.exe
Task: {8A62FE54-7D15-45C0-B4C4-59C29D668007} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-13] (Adobe Systems Incorporated)
Task: {904277F9-3992-4EB0-A332-52EB187234DF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {C334543B-471D-4537-8FFF-468AD3680E1F} - System32\Tasks\HPCustParticipation HP Officejet 4620 series => C:\Program Files\HP\HP Officejet 4620 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {CBD12794-AD90-4585-A6D5-052C62D9C0EA} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-11] (Google)
Task: {DD1E151E-E422-45C4-9DD4-C804AC7637F4} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-04-20] (Acer)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2009-07-25 16:03 - 2009-06-03 08:42 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2009-01-21 00:41 - 2009-01-21 00:41 - 00872448 _____ () C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMediaLibrary.dll
2009-01-21 00:41 - 2009-01-21 00:41 - 00007680 _____ () C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvcPS.dll
2009-07-25 07:31 - 2009-07-25 07:31 - 00200704 _____ () C:\Windows\PLFSetI.exe
2009-07-25 16:05 - 2003-06-07 22:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2009-02-02 16:33 - 2009-02-02 16:33 - 00460199 _____ () C:\Program Files\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2012-08-27 20:33 - 2012-08-27 20:33 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 20:33 - 2012-08-27 20:33 - 01242512 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-07-25 07:29 - 2009-07-25 07:29 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2009-03-31 16:45 - 2009-03-31 16:45 - 00016384 ____R () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-07-25 07:29 - 2009-07-25 07:29 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-02-14 20:57 - 2014-02-13 01:36 - 03578992 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:3064D21D
AlternateDataStreams: C:\ProgramData\Temp:35759C73
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:798A3728
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:B203B914
AlternateDataStreams: C:\ProgramData\Temp:B623B5B8
AlternateDataStreams: C:\ProgramData\Temp:BB24555F
AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE
AlternateDataStreams: C:\ProgramData\Temp:CE0A077E
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-12-22 14:03:06.424
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswSP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-06 11:51:49.719
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-06 11:51:49.143
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 39%
Total physical RAM: 3065.9 MB
Available physical RAM: 1851.39 MB
Total Pagefile: 6362.09 MB
Available Pagefile: 4892.28 MB
Total Virtual: 2047.88 MB
Available Virtual: 1899 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:455.99 GB) (Free:329.47 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 127688D2)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=456 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-14 21:45:39
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: q9lldqdo.exe; Driver: C:\Users\LEVENT~1\AppData\Local\Temp\kxryipog.sys
---- System - GMER 2.1 ----
SSDT 8D06DE56 ZwCreateSection
SSDT 8D06DE60 ZwRequestWaitReplyPort
SSDT 8D06DE5B ZwSetContextThread
SSDT 8D06DE65 ZwSetSecurityObject
SSDT 8D06DE6A ZwSystemDebugControl
SSDT 8D06DDF7 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 828C4860 4 Bytes [56, DE, 06, 8D]
.text ntkrnlpa.exe!KeSetEvent + 539 828C4B84 4 Bytes [60, DE, 06, 8D]
.text ntkrnlpa.exe!KeSetEvent + 56D 828C4BB8 4 Bytes [5B, DE, 06, 8D]
.text ntkrnlpa.exe!KeSetEvent + 5D1 828C4C1C 4 Bytes [65, DE, 06, 8D]
.text ntkrnlpa.exe!KeSetEvent + 619 828C4C64 4 Bytes [6A, DE, 06, 8D]
.text ...
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8E80C000, 0x2C81C4, 0xE8000020]
.text C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl section is writeable [0xA1EFF000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl entry point in ".vmp2" section [0xA1F22050]
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Antivirus@Sources ?avas
Reg HKLM\SYSTEM\ControlSet003\Services\Eventlog\Antivirus@Sources ?avas
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
 |
|
14.02.2014, 22:28
| #2 |
| /// Malwareteam   | buzzsearch, medfos, nextlive, isafe Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld 
__________________ |
|
14.02.2014, 23:00
| #3 |
| | buzzsearch, medfos, nextlive, isafe Danke sunjojo,
__________________das wissen wir zu schaetzen und bedanken uns schon mal! Grüsse |
|
15.02.2014, 10:29
| #4 |
| /// Malwareteam | buzzsearch, medfos, nextlive, isafe Mehrere Antivirenprogramme
Windows XP: Start -> Systemsteuerung -> Kategorieansicht auswählen (falls nicht voreingestellt) -> Software Poste mir bitte noch das Logfile vom AdwCleaner .Schritt 1 Bitte deinstalliere folgende Programme:
Windows XP: Start -> Systemsteuerung -> Kategorieansicht auswählen (falls nicht voreingestellt) -> Softwareund wähle die angegeben Programme aus. Drücke Entfernen (Windows XP) oder Deinstallieren (Windows Vista/7/8). Schritt 2 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S1 iSafeNetFilter; \??\C:\Program Files\iSafe\iSafeNetFilter.sys [X]
R2 Update BuzzSearch; C:\Program Files\BuzzSearch\updateBuzzSearch.exe [80672 2014-02-13] ()
R2 Util BuzzSearch; C:\Program Files\BuzzSearch\bin\utilBuzzSearch.exe [80672 2014-02-13] ()
HKLM\...\Run: [mobilegeni daemon] - C:\Program Files\Mobogenie\DaemonProcess.exe
C:\Program Files\Mobogenie
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [NextLive] - C:\Windows\system32\rundll32.exe "C:\Users\leventselin\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
Startup: C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop_01031103.lnk
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com.tr/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE346DE346
SearchScopes: HKCU - {96AEF64D-9E1E-4F83-9964-2B721427C3A0} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {A00E8FBF-6496-4412-B6DA-5BE71196B00E} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {B919971D-9DEC-4C69-89A0-3757257566A3} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F91BE375-4164-4484-99E2-EEEC62D609B0} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: No Name - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - No File
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No File
BHO: No Name - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - No File
Toolbar: HKLM - No Name - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [jhjjdgbhohaallcimgcmakfiobacimkm] - C:\Program Files\BuzzSearch\jhjjdgbhohaallcimgcmakfiobacimkm.crx [2014-01-08]
2014-02-14 21:06 - 2013-11-20 21:21 - 00000000 ____D () C:\Program Files\BuzzSearch
2014-02-14 21:04 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\newnext.me
2014-02-14 12:11 - 2014-01-02 21:35 - 00008713 _____ () C:\Users\leventselin\daemonprocess.txt
2014-02-13 22:39 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Local\cache
2014-02-13 22:38 - 2014-01-02 21:35 - 00000000 ____D () C:\Users\leventselin\AppData\Local\genienext
C:\Users\leventselin\SkypeSetupFull.exe
C:\Users\Public\AlexaNSISPlugin.4744.dll
AlternateDataStreams: C:\ProgramData\Temp:3064D21D
AlternateDataStreams: C:\ProgramData\Temp:35759C73
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:798A3728
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:B203B914
AlternateDataStreams: C:\ProgramData\Temp:B623B5B8
AlternateDataStreams: C:\ProgramData\Temp:BB24555F
AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE
AlternateDataStreams: C:\ProgramData\Temp:CE0A077E
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 3 Downloade dir bitte Shortcut Cleaner (by Grinler) auf deinen Desktop.
Schritt 4 Bitte setze die Browsereinstellungen von Chrome nach folgender Anleitung zurück: https://support.google.com/chrome/answer/3296214?hl=de Schritt 5 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 6 ESET Online Scanner
Schritt 7 Starte noch einmal FRST.
Sind die von dir genannten Programme noch da? Gibt es noch weitere Probleme? Poste folgende Logfiles in deiner nächsten Antwort:
__________________ Gruß, Jonas |
|
15.02.2014, 21:28
| #5 |
| | buzzsearch, medfos, nextlive, isafe Vielen Dank! Du hast mir sehr geholfen. FRST-Fix Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 12-02-2014 01
Ran by leventselin at 2014-02-15 14:04:26 Run:1
Running from C:\Users\leventselin\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S1 iSafeNetFilter; \??\C:\Program Files\iSafe\iSafeNetFilter.sys [X]
R2 Update BuzzSearch; C:\Program Files\BuzzSearch\updateBuzzSearch.exe [80672 2014-02-13] ()
R2 Util BuzzSearch; C:\Program Files\BuzzSearch\bin\utilBuzzSearch.exe [80672 2014-02-13] ()
HKLM\...\Run: [mobilegeni daemon] - C:\Program Files\Mobogenie\DaemonProcess.exe
C:\Program Files\Mobogenie
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [NextLive] - C:\Windows\system32\rundll32.exe "C:\Users\leventselin\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
Startup: C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop_01031103.lnk
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com.tr/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE346DE346
SearchScopes: HKCU - {96AEF64D-9E1E-4F83-9964-2B721427C3A0} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {A00E8FBF-6496-4412-B6DA-5BE71196B00E} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {B919971D-9DEC-4C69-89A0-3757257566A3} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F91BE375-4164-4484-99E2-EEEC62D609B0} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: No Name - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - No File
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No File
BHO: No Name - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - No File
Toolbar: HKLM - No Name - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [jhjjdgbhohaallcimgcmakfiobacimkm] - C:\Program Files\BuzzSearch\jhjjdgbhohaallcimgcmakfiobacimkm.crx [2014-01-08]
2014-02-14 21:06 - 2013-11-20 21:21 - 00000000 ____D () C:\Program Files\BuzzSearch
2014-02-14 21:04 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\newnext.me
2014-02-14 12:11 - 2014-01-02 21:35 - 00008713 _____ () C:\Users\leventselin\daemonprocess.txt
2014-02-13 22:39 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Local\cache
2014-02-13 22:38 - 2014-01-02 21:35 - 00000000 ____D () C:\Users\leventselin\AppData\Local\genienext
C:\Users\leventselin\SkypeSetupFull.exe
C:\Users\Public\AlexaNSISPlugin.4744.dll
AlternateDataStreams: C:\ProgramData\Temp:3064D21D
AlternateDataStreams: C:\ProgramData\Temp:35759C73
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:798A3728
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:B203B914
AlternateDataStreams: C:\ProgramData\Temp:B623B5B8
AlternateDataStreams: C:\ProgramData\Temp:BB24555F
AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE
AlternateDataStreams: C:\ProgramData\Temp:CE0A077E
*****************
iSafeNetFilter => Service deleted successfully.
Update BuzzSearch => Service deleted successfully.
Util BuzzSearch => Service deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => Value deleted successfully.
"C:\Program Files\Mobogenie" => File/Directory not found.
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\Software\Microsoft\Windows\CurrentVersion\Run\\NextLive => Value deleted successfully.
C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop_01031103.lnk => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Microsoft\Internet Explorer\URLSearchHooks\\ => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{96AEF64D-9E1E-4F83-9964-2B721427C3A0} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{96AEF64D-9E1E-4F83-9964-2B721427C3A0} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A00E8FBF-6496-4412-B6DA-5BE71196B00E} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{A00E8FBF-6496-4412-B6DA-5BE71196B00E} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B919971D-9DEC-4C69-89A0-3757257566A3} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{B919971D-9DEC-4C69-89A0-3757257566A3} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F91BE375-4164-4484-99E2-EEEC62D609B0} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{F91BE375-4164-4484-99E2-EEEC62D609B0} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} => Key deleted successfully.
HKCR\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB} => Key deleted successfully.
HKCR\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7} => Key deleted successfully.
HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BF42D4A8-016E-4fcd-B1EB-837659FD77C6} => Key deleted successfully.
HKCR\CLSID\{BF42D4A8-016E-4fcd-B1EB-837659FD77C6} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value deleted successfully.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.
HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\jhjjdgbhohaallcimgcmakfiobacimkm => Key deleted successfully.
"C:\Program Files\BuzzSearch\jhjjdgbhohaallcimgcmakfiobacimkm.crx" => File/Directory not found.
C:\Program Files\BuzzSearch => Moved successfully.
C:\Users\leventselin\AppData\Roaming\newnext.me => Moved successfully.
C:\Users\leventselin\daemonprocess.txt => Moved successfully.
C:\Users\leventselin\AppData\Local\cache => Moved successfully.
C:\Users\leventselin\AppData\Local\genienext => Moved successfully.
C:\Users\leventselin\SkypeSetupFull.exe => Moved successfully.
C:\Users\Public\AlexaNSISPlugin.4744.dll => Moved successfully.
C:\ProgramData\Temp => ":3064D21D" ADS removed successfully.
C:\ProgramData\Temp => ":35759C73" ADS removed successfully.
C:\ProgramData\Temp => ":373E1720" ADS removed successfully.
C:\ProgramData\Temp => ":798A3728" ADS removed successfully.
C:\ProgramData\Temp => ":9E22BBE8" ADS removed successfully.
C:\ProgramData\Temp => ":ABE89FFE" ADS removed successfully.
C:\ProgramData\Temp => ":B203B914" ADS removed successfully.
C:\ProgramData\Temp => ":B623B5B8" ADS removed successfully.
C:\ProgramData\Temp => ":BB24555F" ADS removed successfully.
C:\ProgramData\Temp => ":CDFF58FE" ADS removed successfully.
C:\ProgramData\Temp => ":CE0A077E" ADS removed successfully.
The system needs a manual reboot.
==== End of Fixlog ====
## leider nicht gespeichert ## MBAM-log Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.15.04 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 leventselin :: LEVENTSELIN-PC [Administrator] 15.02.2014 14:22:20 mbam-log-2014-02-15 (14-22-20).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 228256 Laufzeit: 8 Minute(n), 16 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 6 HKCR\Typelib\{DCABB943-792E-44C4-9029-ECBEE6265AF9} (PUP.Optional.OutBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} (PUP.Optional.OutBrowse) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\BuzzSearch (PUP.Optional.BuzzSearch.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\SEARCHPROTECTINT (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\BuzzSearch (PUP.Optional.BuzzSearch.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\nationzoomSoftware (PUP.Optional.NationZoom.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 1 HKCU\Software\SearchProtectINT|Install (PUP.Optional.SearchProtect.A) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Users\leventselin\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 8 C:\Users\leventselin\AppData\Local\Temp\SPSetup.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\leventselin\AppData\Local\Temp\{DF6F459C-8B89-4F88-B63F-A2E136BB6B79}\VistaCookiesCollector.exe (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Temp\nsh80A7.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Temp\nss81D0.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Temp\nsy3A37.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Temp\nsyACC7.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Installer\3230b4.msi (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\leventselin\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) ## leider schon deinstalliert ohne die log-datei vorher zu sichern - war allerdings erfolgreicher Scann ohne gefundene Threats ### FRST-Scan FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by leventselin (administrator) on LEVENTSELIN-PC on 15-02-2014 21:13:46
Running from C:\Users\leventselin\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Realtek Semiconductor Corp.) C:\Users\leventselin\AppData\Local\Temp\RtkBtMnt.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ArcadeDeluxeAgent] - C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [156968 2009-01-21] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] - C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [202024 2009-01-21] (CyberLink)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-06-02] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6793760 2009-02-19] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2009-07-25] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.)
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1069576 2009-06-25] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [HP Officejet 4620 series (NET)] - C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2009-09-25] (Google Inc.)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\MountPoints2: E - E:\Startme.exe
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\MountPoints2: {de80fdd9-74ef-11e0-ba2a-001f16b73885} - E:\Startme.exe
Startup: C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x209D56E0FE40CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll No File
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 36 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\leventselin\AppData\Roaming\Mozilla\Firefox\Profiles\t7xl4zj4.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll No File
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll No File
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll No File
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll No File
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\leventselin\AppData\Roaming\Mozilla\Firefox\Profiles\t7xl4zj4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-14]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
S3 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
==================== Drivers (Whitelisted) ====================
R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 DCamUSBEMPIA; C:\Windows\System32\DRIVERS\emDevice.sys [171136 2007-06-21] (eMPIA Technology, Inc.)
S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [24448 2007-10-26] (eMPIA Technology, Inc.)
S3 FiltUSBEMPIA; C:\Windows\System32\DRIVERS\emFilter.sys [5248 2007-06-21] (eMPIA Technology, Inc.)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [154272 2008-11-12] (Realtek Semiconductor Corp.)
S3 ScanUSBEMPIA; C:\Windows\System32\DRIVERS\emScan.sys [5120 2007-06-21] (eMPIA Technology, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-16] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [87536 2008-12-26] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-15 14:36 - 2014-02-15 14:37 - 02347384 _____ (ESET) C:\Users\leventselin\Desktop\esetsmartinstaller_enu.exe
2014-02-15 14:19 - 2014-02-15 14:19 - 00000910 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-15 14:19 - 2014-02-15 14:19 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Malwarebytes
2014-02-15 14:19 - 2014-02-15 14:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-15 14:19 - 2014-02-15 14:19 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-15 14:19 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-15 14:17 - 2014-02-15 14:17 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\leventselin\Desktop\mbam-setup-1.75.0.1300.exe
2014-02-15 14:16 - 2014-02-15 14:16 - 00003636 _____ () C:\sc-cleaner.txt
2014-02-15 14:10 - 2014-02-15 14:10 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\leventselin\Desktop\sc-cleaner.exe
2014-02-14 22:31 - 2014-02-14 22:31 - 00000000 ____D () C:\Users\leventselin_2\Documents\Eigene Google Gadgets
2014-02-14 22:31 - 2014-02-14 22:31 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\Acer ePower Management V4
2014-02-14 22:30 - 2014-02-14 22:30 - 00070744 _____ () C:\Users\leventselin_2\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-14 22:30 - 2014-02-14 22:30 - 00001967 _____ () C:\Users\leventselin_2\Desktop\Google Chrome.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000953 _____ () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000948 _____ () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000919 _____ () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\PowerCinema
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\ATI
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\Apple Computer
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\VirtualStore
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\Google
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\ATI
2014-02-14 22:29 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2
2014-02-14 22:29 - 2014-02-14 22:29 - 00000020 ___SH () C:\Users\leventselin_2\ntuser.ini
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Startmenü
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Netzwerkumgebung
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Druckumgebung
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Documents\Eigene Musik
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Documents\Eigene Bilder
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\AppData\Local\Verlauf
2014-02-14 22:29 - 2009-09-30 12:56 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\Microsoft Help
2014-02-14 22:29 - 2009-09-25 16:51 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\Macromedia
2014-02-14 22:29 - 2009-07-25 07:38 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\Acer GameZone Console
2014-02-14 22:29 - 2009-03-12 16:12 - 00000000 ___RD () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-02-14 22:29 - 2009-03-12 16:12 - 00000000 ___RD () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-02-14 21:45 - 2014-02-14 21:45 - 00002956 _____ () C:\Users\leventselin\Desktop\gmer.log
2014-02-14 21:20 - 2014-02-14 21:20 - 00380416 _____ () C:\Users\leventselin\Desktop\q9lldqdo.exe
2014-02-14 21:15 - 2014-02-15 21:13 - 00014147 _____ () C:\Users\leventselin\Desktop\FRST.txt
2014-02-14 21:15 - 2014-02-15 21:13 - 00000000 ____D () C:\FRST
2014-02-14 21:15 - 2014-02-14 21:18 - 00022986 _____ () C:\Users\leventselin\Desktop\Addition.txt
2014-02-14 21:14 - 2014-02-14 21:14 - 01141248 _____ (Farbar) C:\Users\leventselin\Desktop\FRST.exe
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setupact.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000484 _____ () C:\Users\leventselin\Desktop\defogger_disable.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000000 _____ () C:\Users\leventselin\defogger_reenable
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe
2014-02-14 21:09 - 2014-02-14 21:09 - 00001474 _____ () C:\Users\leventselin\Desktop\JRT.txt
2014-02-14 20:57 - 2014-02-14 20:57 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-14 20:57 - 2014-02-14 20:57 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-14 20:47 - 2014-02-15 14:39 - 00019760 _____ () C:\Windows\PFRO.log
2014-02-14 12:10 - 2014-02-14 12:10 - 01037530 _____ (Thisisu) C:\Users\leventselin\Desktop\JRT.exe
2014-02-14 12:10 - 2014-02-14 12:10 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 12:02 - 2014-02-14 21:00 - 00000000 ____D () C:\AdwCleaner
2014-02-14 12:01 - 2014-02-14 12:01 - 01166132 _____ () C:\Users\leventselin\Desktop\adwcleaner.exe
2014-02-14 10:43 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 10:43 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 10:43 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 10:43 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 10:43 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 10:43 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 10:43 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 10:43 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 10:43 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 10:43 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 10:43 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-14 10:43 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 00:56 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\eCyber
2014-01-30 00:47 - 2014-01-30 00:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-01-24 12:49 - 2014-01-24 12:49 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-01-24 12:49 - 2014-01-24 12:49 - 00000000 ____D () C:\ProgramData\Oracle
==================== One Month Modified Files and Folders =======
2014-02-15 21:14 - 2014-02-14 21:15 - 00014147 _____ () C:\Users\leventselin\Desktop\FRST.txt
2014-02-15 21:13 - 2014-02-14 21:15 - 00000000 ____D () C:\FRST
2014-02-15 21:09 - 2009-12-11 21:20 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-15 21:08 - 2012-04-22 21:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-15 21:08 - 2011-11-01 20:06 - 01404435 _____ () C:\Windows\WindowsUpdate.log
2014-02-15 14:39 - 2014-02-14 20:47 - 00019760 _____ () C:\Windows\PFRO.log
2014-02-15 14:39 - 2009-12-11 21:20 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-15 14:39 - 2009-09-25 16:50 - 00000000 ____D () C:\Program Files\Google
2014-02-15 14:39 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-15 14:39 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-15 14:39 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-15 14:39 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system
2014-02-15 14:38 - 2006-11-02 14:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-15 14:37 - 2014-02-15 14:36 - 02347384 _____ (ESET) C:\Users\leventselin\Desktop\esetsmartinstaller_enu.exe
2014-02-15 14:19 - 2014-02-15 14:19 - 00000910 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-15 14:19 - 2014-02-15 14:19 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Malwarebytes
2014-02-15 14:19 - 2014-02-15 14:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-15 14:19 - 2014-02-15 14:19 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-15 14:17 - 2014-02-15 14:17 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\leventselin\Desktop\mbam-setup-1.75.0.1300.exe
2014-02-15 14:16 - 2014-02-15 14:16 - 00003636 _____ () C:\sc-cleaner.txt
2014-02-15 14:16 - 2009-09-25 16:51 - 00000953 _____ () C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-15 14:13 - 2009-09-25 16:51 - 00000000 ____D () C:\Users\leventselin\AppData\Local\Google
2014-02-15 14:11 - 2014-01-02 22:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-15 14:10 - 2014-02-15 14:10 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\leventselin\Desktop\sc-cleaner.exe
2014-02-15 14:04 - 2009-09-25 16:50 - 00000000 ____D () C:\Users\leventselin
2014-02-15 14:04 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-02-15 13:49 - 2006-11-02 11:23 - 00002577 _____ () C:\Windows\system32\config.nt
2014-02-14 22:31 - 2014-02-14 22:31 - 00000000 ____D () C:\Users\leventselin_2\Documents\Eigene Google Gadgets
2014-02-14 22:31 - 2014-02-14 22:31 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\Acer ePower Management V4
2014-02-14 22:30 - 2014-02-14 22:30 - 00070744 _____ () C:\Users\leventselin_2\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-14 22:30 - 2014-02-14 22:30 - 00001967 _____ () C:\Users\leventselin_2\Desktop\Google Chrome.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000953 _____ () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000948 _____ () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000919 _____ () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\PowerCinema
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\ATI
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Roaming\Apple Computer
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\VirtualStore
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\Google
2014-02-14 22:30 - 2014-02-14 22:30 - 00000000 ____D () C:\Users\leventselin_2\AppData\Local\ATI
2014-02-14 22:30 - 2014-02-14 22:29 - 00000000 ____D () C:\Users\leventselin_2
2014-02-14 22:29 - 2014-02-14 22:29 - 00000020 ___SH () C:\Users\leventselin_2\ntuser.ini
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Startmenü
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Netzwerkumgebung
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Druckumgebung
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Documents\Eigene Musik
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\Documents\Eigene Bilder
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-02-14 22:29 - 2014-02-14 22:29 - 00000000 _SHDL () C:\Users\leventselin_2\AppData\Local\Verlauf
2014-02-14 21:45 - 2014-02-14 21:45 - 00002956 _____ () C:\Users\leventselin\Desktop\gmer.log
2014-02-14 21:20 - 2014-02-14 21:20 - 00380416 _____ () C:\Users\leventselin\Desktop\q9lldqdo.exe
2014-02-14 21:18 - 2014-02-14 21:15 - 00022986 _____ () C:\Users\leventselin\Desktop\Addition.txt
2014-02-14 21:14 - 2014-02-14 21:14 - 01141248 _____ (Farbar) C:\Users\leventselin\Desktop\FRST.exe
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setupact.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000484 _____ () C:\Users\leventselin\Desktop\defogger_disable.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000000 _____ () C:\Users\leventselin\defogger_reenable
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe
2014-02-14 21:09 - 2014-02-14 21:09 - 00001474 _____ () C:\Users\leventselin\Desktop\JRT.txt
2014-02-14 21:00 - 2014-02-14 12:02 - 00000000 ____D () C:\AdwCleaner
2014-02-14 20:58 - 2009-10-25 11:56 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Mozilla
2014-02-14 20:57 - 2014-02-14 20:57 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-14 20:57 - 2014-02-14 20:57 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-14 20:43 - 2011-05-26 13:14 - 00000000 ____D () C:\Program Files\Samsung
2014-02-14 20:42 - 2009-02-11 21:16 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-02-14 20:39 - 2014-01-02 22:03 - 00000000 ____D () C:\ProgramData\WPM
2014-02-14 20:37 - 2011-09-15 18:15 - 00000000 ____D () C:\ProgramData\Norton
2014-02-14 20:35 - 2014-01-02 21:35 - 00000000 ____D () C:\Users\leventselin\AppData\Local\Mobogenie
2014-02-14 20:33 - 2011-05-26 13:16 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Samsung
2014-02-14 20:33 - 2011-05-26 13:16 - 00000000 ____D () C:\Program Files\PC Connectivity Solution
2014-02-14 20:15 - 2012-12-13 14:38 - 00000000 ____D () C:\ProgramData\Zbshareware Lab
2014-02-14 20:13 - 2009-03-12 03:59 - 00000000 ____D () C:\Program Files\Acer GameZone
2014-02-14 12:30 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-14 12:10 - 2014-02-14 12:10 - 01037530 _____ (Thisisu) C:\Users\leventselin\Desktop\JRT.exe
2014-02-14 12:10 - 2014-02-14 12:10 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 12:04 - 2009-10-25 11:56 - 00000000 ____D () C:\ProgramData\ICQ
2014-02-14 12:01 - 2014-02-14 12:01 - 01166132 _____ () C:\Users\leventselin\Desktop\adwcleaner.exe
2014-02-14 11:03 - 2006-11-02 11:33 - 01469650 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-14 10:59 - 2013-08-15 14:56 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 10:53 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-13 22:27 - 2012-04-22 21:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-13 22:27 - 2011-09-16 13:48 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-13 22:25 - 2009-12-03 22:04 - 00000000 ____D () C:\Users\leventselin\AppData\Local\Adobe
2014-02-10 19:31 - 2012-10-21 14:32 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 19:30 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\eCyber
2014-02-10 18:55 - 2009-09-29 13:13 - 00000000 ____D () C:\Users\leventselin\Tracing
2014-02-09 21:58 - 2009-10-05 14:52 - 00007160 _____ () C:\Users\leventselin\AppData\Local\d3d9caps.dat
2014-02-05 09:58 - 2014-02-14 10:43 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-14 10:43 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-14 10:43 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-14 10:43 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-14 10:43 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-14 10:43 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-14 10:43 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-14 10:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-14 10:43 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-14 10:43 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-14 10:43 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-14 10:43 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-01-30 00:47 - 2014-01-30 00:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-01-30 00:46 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-01-24 12:49 - 2014-01-24 12:49 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-01-24 12:49 - 2014-01-24 12:49 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-24 12:49 - 2009-09-29 11:56 - 00000000 ____D () C:\Program Files\Java
2014-01-16 22:44 - 2009-03-12 04:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
Some content of TEMP:
====================
C:\Users\leventselin\AppData\Local\Temp\avgnt.exe
C:\Users\leventselin\AppData\Local\Temp\Quarantine.exe
C:\Users\leventselin\AppData\Local\Temp\RtkBtMnt.exe
C:\Users\leventselin_2\AppData\Local\Temp\avgnt.exe
C:\Users\leventselin_2\AppData\Local\Temp\RtkBtMnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-15 14:47
==================== End Of Log ============================
--- --- --- Einen schönen Samstag Abend noch |
|
16.02.2014, 11:11
| #6 | ||||||||
| /// Malwareteam | buzzsearch, medfos, nextlive, isafe Updates Adobe Reader 11.0.06
Cleanup Falls du Malwarebytes Anti-Malware und den ESET Online Scanner nicht mehr behalten möchtest, kannst du diese über die Systemsteuerung deinstallieren. Ich empfehle dir, mindestens ein Programm zu behalten (näheres in den Tipps). Windows XP: Start --> Systemsteuerung --> Kategorieansicht auswählen (falls nicht voreingestellt) --> SoftwareDie Reihenfolge ist hier entscheidend.
In deinen Logfiles sehe ich keine schädlichen Einträge mehr, du bist in meinen Augen Clean. Für die Zukunft habe ich dir Tipps aufgeschrieben, damit du uns in nächster Zeit nicht mehr brauchst .Tipps - Frequently Asked Questions (FAQ)/Häufig gestellte Fragen Welcher Antivirenscanner ist der Beste?
Aber Updates muss ich immer installieren, oder?
Ok, muss ich auf etwas achten, wenn ich im Internet surfe?
Welche Programme sollte ich nicht verwenden?
Gibt es noch weitere Tipps, um mich zu schützen?
Wenn du die Arbeit des Trojaner-Boards unterstützen möchtest, kannst du gerne spenden .Ich wünsche dir eine schöne und malwarefreie Zeit  .
__________________ --> buzzsearch, medfos, nextlive, isafe |
|
19.02.2014, 18:23
| #7 |
| /// Malwareteam | buzzsearch, medfos, nextlive, isafe Hallo dreamteam, schön, dass wir dir helfen konnten .Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht, damit erhalte ich keine Benachrichtungen über neue Antworten in diesem Thread. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder Andere bitte hier klicken und einen eigenen Thread erstellen.
__________________ Gruß, Jonas |
|
| Themen zu buzzsearch, medfos, nextlive, isafe |
| antivir, avira, branding, device driver, error, excel, google, homepage, launch, mobogenie, mobogenie entfernen, mozilla, nationzoom, nationzoom entfernen, nextlive, officejet, pup.optional.buzzsearch.a, pup.optional.conduit.a, pup.optional.nationzoom.a, pup.optional.nextlive.a, pup.optional.outbrowse, pup.optional.searchprotect.a, pup.optional.sweetim, realtek, svchost.exe, windows |
Linear-Darstellung
