|
Plagegeister aller Art und deren Bekämpfung: Renitente Malware eingefangen?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
17.02.2014, 14:46 | #1 |
| Renitente Malware eingefangen? Hallo Forum, wollte einen Film streamen und muß was falsches gedrückt haben. Seitdem habe ich folgende Probleme mit dem Browser (egal ob ich Firefox oder IE nutze): neue Internetseiten öffnen sich sehr langsam. Diverse andere, ungewollte Fenster öffnen sich zuerst, muß ich immer wegdrücken. Ständig kommen ungewollte Pop Ups. Diverse Seiten lassen sich nicht mehr ordentlich manövrieren. Z.B. kann ich zwar noch auf Facebook, von dort aber kein Spotify mehr öffnen. Oder Stepstone, das Jobportal - kann nur auf der jeweils ersten Seite suchen, aber keine Seite weiter gehen. Ich bin in die Programme gegangen und habe alle zum fraglichen Zeitpunkt neu installierten Programme gelöscht. Einige lassen sich nicht löschen mit der Fehlermeldung, Datei oder Ordner sei noch wo anders in Gebrauch. Firefox habe ich ebenfalls deinstalliert und dann wieder neu installiert. Und ich habe von Windows 8 auf 8.1 upgegradet. Hat aber alles nichts geholfen, die oben beschriebenen Probleme sind weiterhin vorhanden. Kann mir von euch jemand weiterhelfen? Vielen Dank! |
17.02.2014, 14:51 | #2 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Renitente Malware eingefangen? Hallo und
__________________Zitat:
Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
17.02.2014, 15:06 | #3 |
| Renitente Malware eingefangen? Hallo cosinus, vielen Dank für die schnelle Reaktion. Ich war auf kkiste.to
__________________Wie kann ich einen Log oder Logfile machen? Hier kommt der LogFRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-02-2014 Ran by Rainer at 2014-02-17 15:04:36 Running from C:\Users\Rainer\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov) Adobe Bridge 1.0 (x32 Version: 001.000.001 - Adobe Systems) Hidden Adobe Common File Installer (x32 Version: 1.00.001 - Adobe System Incorporated) Hidden Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated) Adobe Help Center 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden Adobe Photoshop CS2 (x32 Version: 9.0 - Adobe Systems, Inc.) Adobe Photoshop CS2 (x32 Version: 9.0 - Adobe Systems, Inc.) Hidden Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated) Adobe Stock Photos 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.) Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.) Hidden ALDI TALK Verbindungsassistent (x32 Version: ALDI TALK 4.0 - ALDI TALK Verbindungsassistent) Apple Application Support (x32 Version: 2.3.6 - Apple Inc.) Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.) Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.) ASUS Instant Connect (x32 Version: 1.2.8 - ASUS) ASUS InstantOn (x32 Version: 3.0.4 - ASUS) ASUS LifeFrame3 (x32 Version: 3.1.9 - ASUS) ASUS Live Update (x32 Version: 3.1.9 - ASUS) ASUS Power4Gear Hybrid (Version: 2.0.4 - ASUS) ASUS Smart Gesture (x32 Version: 1.0.36 - ASUS) ASUS Splendid Video Enhancement Technology (x32 Version: 1.03.0005 - ASUS) ASUS Tutor (x32 Version: 1.0.7 - ASUS) ASUS USB Charger Plus (x32 Version: 2.1.5 - ASUS) ASUS WebStorage Sync Agent (x32 Version: 1.1.9.120 - ASUS Cloud Corporation) ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.7 - Atheros Communications Inc.) ATK Package (x32 Version: 1.0.0025 - ASUS) Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira) Avira SearchFree Toolbar (x32 Version: 12.10.0.2948 - APN, LLC) Bonjour (Version: 3.0.0.10 - Apple Inc.) Common Desktop Agent (Version: 1.62.0 - OEM) Hidden HUAWEI DataCard Driver 4.20.12.00 (x32 Version: 4.20.12.00 - Huawei technologies Co., Ltd.) Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (x32 Version: 9.17.10.3347 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation) Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden iTunes (Version: 11.1.0.126 - Apple Inc.) McAfee Security Scan Plus (Version: 3.8.141.11 - McAfee, Inc.) Microsoft Office 64-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Home and Student 2013 - de-de (Version: 15.0.4551.1512 - Microsoft Corporation) Microsoft Office Korrekturhilfen 2013 - Deutsch (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office OSM MUI (German) 2013 (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2013 (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - English (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - Italiano (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2013 (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation) Microsoft Visio MUI (German) 2013 (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Visio Professional 2013 (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Microsoft Visio Professional 2013 (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation) Mobile Connection Manager (x32 Version: - Mobile Connection Manager) Mozilla Firefox 27.0.1 (x86 de) (x32 Version: 27.0.1 - Mozilla) Mozilla Maintenance Service (x32 Version: 27.0.1 - Mozilla) Nur Entfernen der CopyTrans Suite möglich (HKCU Version: 2.37 - WindSolutions) Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1512 - Microsoft Corporation) Hidden Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden Optimizer Pro v3.2 (x32 Version: - ) <==== ATTENTION Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4420.1017 - Microsoft Corporation) Hidden PDF24 Creator 6.0.1 (x32 Version: - PDF24.org) Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden Re-markit (x32 Version: - Re-markit Software) <==== ATTENTION Samsung Easy Document Creator (x32 Version: 1.04.06 (07/08/2012) - Samsung Electronics Co., Ltd.) Samsung Easy Printer Manager (x32 Version: 1.02.74.00(06/11/2012) - Samsung Electronics Co., Ltd.) Samsung OCR Software (x32 Version: 1.00.05 (10/07/2012) - Samsung Electronics Co., Ltd.) Samsung Printer Live Update (x32 Version: 1.01.00.04 - Samsung Electronics Co., Ltd.) Samsung Scan Process Machine (x32 Version: 1.00.20.02 - Samsung Electronics Co., Ltd.) Hidden Samsung SCX-3400 Series (x32 Version: 1.15 (11/12/2012) - Samsung Electronics Co., Ltd.) Scribus 1.4.2 (x32 Version: 1.4.2 - The Scribus Team) Shared C Run-time for x64 (Version: 10.0.0 - McAfee) SNS Upload for Easy Document Creator (x32 Version: 1.0.0 - Samsung Electronics Co.,Ltd) TeamViewer 8 (x32 Version: 8.0.19045 - TeamViewer) VIA Platform Device Manager (x32 Version: 1.39 - VIA Technologies, Inc.) VLC media player 2.1.3 (x32 Version: 2.1.3 - VideoLAN) VO Package (x32 Version: 1.0.0.0 - ) Windows Driver Package - ASUS (ATP) Mouse (11/09/2012 1.0.0.153) (Version: 11/09/2012 1.0.0.153 - ASUS) WinFlash (x32 Version: 2.41.1 - ASUS) Wondershare MobileTrans ( Version 3.5.1 ) (x32 Version: 3.5.1 - Wondershare) ==================== Restore Points ========================= 17-02-2014 10:39:21 Windows Update ==================== Hosts content: ========================== 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {035792A1-D4EF-4A78-BF9A-AA9628C281A3} - System32\Tasks\Microsoft\Windows\Setup\SetupCleanupTask Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask Task: {06CC19F0-7E20-41C4-B5CD-684BD2B9CC72} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-02-17] (Microsoft Corporation) Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList Task: {0F29556E-5E3D-4C87-BE72-E2C264DDECCF} - System32\Tasks\ASUS InstantOn Config => C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe [2012-09-24] (ASUS) Task: {11179D97-3C63-4264-88A3-7DEC11D98A0B} - System32\Tasks\Re-markit Update => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe [2014-02-14] () <==== ATTENTION Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate Task: {322EE6C6-97DB-46B8-B34A-D8B8D1C66C16} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-09-18] (ASUSTek Computer Inc.) Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation) Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation) Task: {3C7DC969-AEAB-470C-BBA3-7FBB1F7ACCF9} - System32\Tasks\Feven Pro-chromeinstaller => C:\Program Files (x86)\Feven Pro\Feven Pro-chromeinstaller.exe <==== ATTENTION Task: {3D1C3DCB-5C7F-4D17-A3FF-BAE9C848498D} - System32\Tasks\ASUS Patch for VIA Audio => C:\Windows\system32\AsPatchViaAudio.exe [2012-11-07] (ASUSTek Computer INC.) Task: {44050022-F045-4454-A9CC-164F647676F5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance Task: {633E840C-31C4-4352-8DA3-A88B4E0D3707} - System32\Tasks\SpeedUpMyPC Startup => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe Task: {643C6AAE-88EA-4567-BD44-364B0DF08B97} - System32\Tasks\MediaPlayerEnhance-chromeinstaller => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-chromeinstaller.exe Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup Task: {6DEBD244-116A-45E5-9D6D-E2F04D3666DA} - System32\Tasks\MediaPlayerEnhance-firefoxinstaller => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-firefoxinstaller.exe Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task Task: {7397FD90-8AFC-4B68-9B5B-4CE738311A80} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation) Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState Task: {7911E415-A27A-4F68-8718-C202E1C43868} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS) Task: {79BDF823-0CCE-45E6-8484-FCAD3A3A19CB} - System32\Tasks\Feven Pro-firefoxinstaller => C:\Program Files (x86)\Feven Pro\Feven Pro-firefoxinstaller.exe <==== ATTENTION Task: {8601AE40-916C-4A09-8089-B867F0AFCF44} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task Task: {8A2734DF-6512-4342-AA9B-F0D5E13B00EA} - System32\Tasks\SpeedUpMyPC Maintenance => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe Task: {8C24E753-67A2-42E1-8F36-A80CDE3B0AA4} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-11-20] (AsusTek) Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask Task: {8FF009EF-2862-4A2E-AA45-EA0C120623E6} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation) Task: {95D274A8-D9C8-452C-907F-1EBDCA196AB5} - System32\Tasks\MediaPlayerEnhance-updater => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-updater.exe Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work Task: {A490EA04-5DA4-4D1E-B4C2-263BBD3C4FB2} - System32\Tasks\Feven Pro-updater => C:\Program Files (x86)\Feven Pro\Feven Pro-updater.exe <==== ATTENTION Task: {C1ED055D-B7EE-4F99-949B-8493A9CC0DFA} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-10-31] (Microsoft Corporation) Task: {C34C46CC-2AB7-4A67-8BE7-1F87316C33C6} - System32\Tasks\Feven Pro-enabler => C:\Program Files (x86)\Feven Pro\Feven Pro-enabler.exe <==== ATTENTION Task: {C85F5E79-67B4-406A-BDD4-FE31E3FD6209} - System32\Tasks\Re-markit_wd => C:\Program Files (x86)\Re-markit\Re-markit_wd.exe [2014-02-14] () <==== ATTENTION Task: {CB4D45DF-9D20-4C7A-89EF-EAE1C4BBF377} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-06] (Adobe Systems Incorporated) Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing Task: {D978701B-A21E-4FA7-806D-1A318DB1839C} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization Task: {DE62B220-D21A-43EB-9B88-4A8E727718E2} - System32\Tasks\MediaPlayerEnhance-codedownloader => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-codedownloader.exe Task: {E42DB4C1-0380-40CB-96DE-8540E18FD0B9} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.) Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE Task: {E9B58982-B13B-42E4-8DA3-0B524B704E4E} - System32\Tasks\MediaPlayerEnhance-enabler => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-enabler.exe <==== ATTENTION Task: {EC69800F-0156-4B12-AF64-5D3B5062745D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-16] (Microsoft Corporation) Task: {FFE30BC7-312C-4A66-9E56-0B85C0FC6A5B} - System32\Tasks\Feven Pro-codedownloader => C:\Program Files (x86)\Feven Pro\Feven Pro-codedownloader.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\Feven Pro-chromeinstaller.job => C:\Program Files (x86)\Feven Pro\Feven Pro-chromeinstaller.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\Feven Pro-codedownloader.job => C:\Program Files (x86)\Feven Pro\Feven Pro-codedownloader.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\Feven Pro-enabler.job => C:\Program Files (x86)\Feven Pro\Feven Pro-enabler.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\Feven Pro-firefoxinstaller.job => C:\Program Files (x86)\Feven Pro\Feven Pro-firefoxinstaller.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\Feven Pro-updater.job => C:\Program Files (x86)\Feven Pro\Feven Pro-updater.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\MediaPlayerEnhance-chromeinstaller.job => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-chromeinstaller.exe Task: C:\WINDOWS\Tasks\MediaPlayerEnhance-codedownloader.job => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-codedownloader.exe Task: C:\WINDOWS\Tasks\MediaPlayerEnhance-enabler.job => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-enabler.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\MediaPlayerEnhance-firefoxinstaller.job => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-firefoxinstaller.exe Task: C:\WINDOWS\Tasks\MediaPlayerEnhance-updater.job => C:\Program Files (x86)\MediaPlayerEnhance\MediaPlayerEnhance-updater.exe Task: C:\WINDOWS\Tasks\Re-markit Update.job => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\Re-markit_wd.job => C:\Program Files (x86)\Re-markit\Re-markit_wd.exe <==== ATTENTION Task: C:\WINDOWS\Tasks\SpeedUpMyPC Maintenance.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe Task: C:\WINDOWS\Tasks\SpeedUpMyPC Startup.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe ==================== Loaded Modules (whitelisted) ============= 2012-08-24 18:26 - 2012-08-24 18:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll 2014-02-14 22:36 - 2014-02-14 22:36 - 00093184 _____ () C:\Program Files (x86)\Re-markit\Re-markit_wd.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2013-01-08 06:23 - 2012-10-25 10:26 - 00078456 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll 2013-01-08 06:23 - 2012-10-25 10:26 - 00386168 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll 2012-02-20 21:23 - 2012-02-20 21:23 - 00456704 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe 2012-02-20 21:23 - 2012-02-20 21:23 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll 2013-09-14 19:10 - 2013-09-14 19:09 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll 2013-06-27 20:02 - 2013-06-27 22:12 - 00358968 _____ () C:\Program Files (x86)\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe 2013-09-13 18:51 - 2013-09-13 18:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2013-09-13 18:51 - 2013-09-13 18:51 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-02-14 22:36 - 2014-02-14 22:36 - 00180736 _____ () C:\Program Files (x86)\Re-markit\Re-markit153.exe 2013-01-08 06:22 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll 2012-09-11 15:01 - 2012-09-11 15:01 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll 2014-02-15 11:00 - 2014-02-13 01:36 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Users\Rainer\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (02/17/2014 02:23:51 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 3609 Error: (02/17/2014 02:23:51 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 3609 Error: (02/17/2014 02:12:38 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/17/2014 02:12:37 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 2453 Error: (02/17/2014 02:12:37 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 2453 Error: (02/17/2014 02:12:37 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/17/2014 00:15:17 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16518, Zeitstempel: 0x52f347b2 Name des fehlerhaften Moduls: IEFRAME.dll, Version: 11.0.9600.16518, Zeitstempel: 0x52f34fb3 Ausnahmecode: 0xc0000005 Fehleroffset: 0x002086a2 ID des fehlerhaften Prozesses: 0x14bfc Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0 Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1 Pfad des fehlerhaften Moduls: IEXPLORE.EXE2 Berichtskennung: IEXPLORE.EXE3 Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5 Error: (02/17/2014 11:50:41 AM) (Source: Application Hang) (User: ) Description: Programm LiveComm.exe, Version 17.4.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 140f4 Startzeit: 01cf2bcc7250ad3b Endzeit: 4294967295 Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.4.9600.16384_x64__8wekyb3d8bbwe\LiveComm.exe Berichts-ID: 66501846-97c0-11e3-824f-08606e951e21 Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.4.9600.16384_x64__8wekyb3d8bbwe Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1 Error: (02/17/2014 00:38:13 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 1343 Error: (02/17/2014 00:38:13 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 1343 System errors: ============= Error: (02/17/2014 02:53:53 PM) (Source: Microsoft-Windows-Kernel-Power) (User: ) Description: 4 Error: (02/17/2014 02:49:57 PM) (Source: Microsoft-Windows-Kernel-Power) (User: ) Description: 4 Error: (02/17/2014 02:12:38 PM) (Source: Microsoft-Windows-Kernel-Power) (User: ) Description: 4 Error: (02/17/2014 10:00:21 AM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (02/17/2014 00:38:13 AM) (Source: Microsoft-Windows-Kernel-Power) (User: ) Description: 4 Error: (02/17/2014 00:06:39 AM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252. Error: (02/17/2014 00:06:39 AM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252. Error: (02/16/2014 07:08:53 PM) (Source: Microsoft-Windows-Kernel-Power) (User: ) Description: 4 Error: (02/16/2014 05:01:37 PM) (Source: Microsoft-Windows-Kernel-Power) (User: ) Description: 4 Error: (02/16/2014 04:19:35 PM) (Source: Microsoft-Windows-Kernel-Power) (User: ) Description: 4 Microsoft Office Sessions: ========================= Error: (02/17/2014 02:23:51 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 3609 Error: (02/17/2014 02:23:51 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 3609 Error: (02/17/2014 02:12:38 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/17/2014 02:12:37 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 2453 Error: (02/17/2014 02:12:37 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 2453 Error: (02/17/2014 02:12:37 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/17/2014 00:15:17 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE11.0.9600.1651852f347b2IEFRAME.dll11.0.9600.1651852f34fb3c0000005002086a214bfc01cf2bcf163a1461C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\WINDOWS\SYSTEM32\IEFRAME.dllc72f1a5b-97c4-11e3-824f-08606e951e21 Error: (02/17/2014 11:50:41 AM) (Source: Application Hang)(User: ) Description: LiveComm.exe17.4.9600.16384140f401cf2bcc7250ad3b4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.4.9600.16384_x64__8wekyb3d8bbwe\LiveComm.exe66501846-97c0-11e3-824f-08606e951e21microsoft.windowscommunicationsapps_17.4.9600.16384_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1 Error: (02/17/2014 00:38:13 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 1343 Error: (02/17/2014 00:38:13 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 1343 ==================== Memory info =========================== Percentage of memory in use: 76% Total physical RAM: 3979.68 MB Available physical RAM: 928.28 MB Total Pagefile: 5452.53 MB Available Pagefile: 1257.97 MB Total Virtual: 131072 MB Available Virtual: 131071.78 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:185.96 GB) (Free:129.16 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (Data) (Fixed) (Total:258.15 GB) (Free:258.02 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 04A53D1B) Partition: GPT Partition Type ==================== End Of Log ============================ |
17.02.2014, 15:37 | #4 | ||
/// Winkelfunktion /// TB-Süch-Tiger™ | Renitente Malware eingefangen?Zitat:
Zitat:
Es fehlt: a) die Angabe zu bisherigen Funden und falls es welche gab die Logs dazu b) das andere FRST Log
__________________ Logfiles bitte immer in CODE-Tags posten |
Themen zu Renitente Malware eingefangen? |
browser, datei, diverse, diverse seiten, fehlermeldung, fenster öffnen sich, film, firefox, folge, forum, gen, internetseite, internetseiten öffnen sich, löschen, malware, neue, nicht löschen, nicht mehr, ordner, probleme, programme, seite, seiten, seiten öffnen sich, suche, ungewollte, windows, öffnen |