|
Log-Analyse und Auswertung: RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dllWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
24.03.2014, 18:11 | #1 |
| RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dllCode:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Jacky (administrator) on JACKY-PC on 24-03-2014 18:03:52 Running from D:\Heruntergeladen Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= () C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIKE.EXE (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIKE.EXE (Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [COMODO Internet Security] - C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1612504 2013-11-11] (COMODO) HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5263504 2012-08-09] (VIA) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-29] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) HKLM-x32\...\RunOnce: [EasyTuneVI] - C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] () Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe [202024 2007-09-20] (Nero AG) HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\MountPoints2: {793c3345-7ed0-11e3-a52f-74d43502932a} - G:\SETUP.EXE HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\MountPoints2: {bb098fe1-7e1d-11e3-ba28-806e6f6e6963} - E:\Run.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG&q={searchTerms} Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default FF NewTab: hxxp://www.awesomehp.com/newtab/?type=nt&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG FF DefaultSearchEngine: awesomehp FF SelectedSearchEngine: awesomehp FF Homepage: www.google.de FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jacky\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\awesomehp.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Quick Start - C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default\Extensions\quick_start@gmail.com [2014-02-20] FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default\extensions\quick_start@gmail.com FF Extension: Quick Start - C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default\extensions\quick_start@gmail.com [2014-02-20] ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-11-29] (Advanced Micro Devices, Inc.) R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6254152 2013-10-20] (COMODO) S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [164056 2013-09-24] (COMODO) R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation) R3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [382248 2007-09-20] (Nero AG) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-03] (VIA Technologies, Inc.) S2 VOsrv; C:\Users\Jacky\AppData\Roaming\VOPackage\VOsrv.exe [X] ==================== Drivers (Whitelisted) ==================== R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices) R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-09-24] (COMODO) R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [709144 2013-11-14] (COMODO) R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [48872 2013-09-24] (COMODO) R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2014-03-24] () R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [96800 2013-09-24] (COMODO) R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [231112 2013-01-03] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [301256 2013-01-03] (VIA Technologies, Inc.) S2 ASInsHelp; \??\C:\Windows\SysWow64\drivers\AsInsHelp64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-24 17:29 - 2014-03-24 18:03 - 00000000 ____D () C:\FRST 2014-03-24 17:23 - 2014-03-24 17:23 - 00000056 _____ () C:\Windows\setupact.log 2014-03-24 17:23 - 2014-03-24 17:23 - 00000000 _____ () C:\Windows\setuperr.log 2014-03-24 07:56 - 2014-03-24 08:01 - 00000000 ____D () C:\Program Files (x86)\Advanced Fix 2014 2014-03-23 13:34 - 2014-03-23 13:34 - 00000829 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-03-19 07:50 - 2014-03-19 23:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-03-12 20:59 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-12 20:59 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-12 20:59 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-12 20:59 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-12 20:59 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-12 20:59 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-12 20:59 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-12 20:59 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-05 18:23 - 2014-03-05 18:23 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\EPSON 2014-02-26 18:02 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-02-26 18:02 - 2014-01-03 23:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-02-24 22:21 - 2014-02-24 22:21 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2014-02-23 21:41 - 2014-02-23 21:44 - 00000069 _____ () C:\Windows\NeroDigital.ini 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\Nero 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Local\Ahead 2014-02-23 19:46 - 2014-02-23 19:46 - 00000188 _____ () C:\Windows\SysWOW64\MsiExec.exe.log 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\ProgramData\Nero 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\Program Files (x86)\Nero 2014-02-23 19:43 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll 2014-02-23 19:43 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll ==================== One Month Modified Files and Folders ======= 2014-03-24 18:03 - 2014-03-24 17:29 - 00000000 ____D () C:\FRST 2014-03-24 18:03 - 2014-01-15 20:59 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat 2014-03-24 17:43 - 2014-01-15 21:39 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-24 17:30 - 2009-07-14 05:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-24 17:30 - 2009-07-14 05:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-24 17:29 - 2014-01-16 05:44 - 00699092 _____ () C:\Windows\system32\perfh007.dat 2014-03-24 17:29 - 2014-01-16 05:44 - 00149232 _____ () C:\Windows\system32\perfc007.dat 2014-03-24 17:29 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-24 17:27 - 2014-01-15 20:50 - 01633160 _____ () C:\Windows\WindowsUpdate.log 2014-03-24 17:23 - 2014-03-24 17:23 - 00000056 _____ () C:\Windows\setupact.log 2014-03-24 17:23 - 2014-03-24 17:23 - 00000000 _____ () C:\Windows\setuperr.log 2014-03-24 17:23 - 2014-02-02 17:03 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref 2014-03-24 17:23 - 2014-01-15 22:18 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys 2014-03-24 17:23 - 2014-01-15 21:14 - 00030528 _____ () C:\Windows\GVTDrv64.sys 2014-03-24 17:23 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-24 08:11 - 2014-01-15 21:21 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\Winamp 2014-03-24 08:09 - 2014-01-15 20:50 - 00000000 ____D () C:\Users\Jacky 2014-03-24 08:01 - 2014-03-24 07:56 - 00000000 ____D () C:\Program Files (x86)\Advanced Fix 2014 2014-03-24 08:00 - 2014-02-14 17:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-03-24 08:00 - 2014-01-16 19:14 - 00000000 ____D () C:\Program Files\CCleaner 2014-03-23 14:19 - 2014-02-20 20:12 - 00000000 ____D () C:\Users\Jacky\AppData\Local\genienext 2014-03-23 14:18 - 2014-02-20 20:12 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\newnext.me 2014-03-23 13:34 - 2014-03-23 13:34 - 00000829 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-03-20 07:42 - 2014-01-16 18:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-19 23:53 - 2014-03-19 07:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-03-15 15:28 - 2014-01-20 14:20 - 00000000 ____D () C:\Users\Jacky\Desktop\Ebay 2014-03-13 07:34 - 2009-07-14 05:45 - 00342152 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-13 07:33 - 2014-01-16 20:17 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-13 07:33 - 2014-01-16 20:17 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-12 21:03 - 2014-01-15 21:19 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-12 21:01 - 2014-01-16 18:16 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-03-12 21:01 - 2014-01-15 21:19 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-03-12 10:43 - 2014-01-15 21:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-12 10:43 - 2014-01-15 21:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-12 10:43 - 2014-01-15 21:39 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-08 14:14 - 2014-01-20 16:51 - 00000000 ____D () C:\Users\Jacky\AppData\Local\Unity 2014-03-05 18:23 - 2014-03-05 18:23 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\EPSON 2014-03-05 06:42 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-04 20:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-28 19:42 - 2014-01-16 20:03 - 00000467 _____ () C:\Windows\wiso.ini 2014-02-28 19:40 - 2014-01-16 20:01 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH 2014-02-24 22:21 - 2014-02-24 22:21 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2014-02-23 21:44 - 2014-02-23 21:41 - 00000069 _____ () C:\Windows\NeroDigital.ini 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\Nero 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Local\Ahead 2014-02-23 19:46 - 2014-02-23 19:46 - 00000188 _____ () C:\Windows\SysWOW64\MsiExec.exe.log 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\ProgramData\Nero 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\Program Files (x86)\Nero 2014-02-23 19:45 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-21 18:35 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 Ran by Jacky at 2014-03-24 17:30:40 Running from D:\Heruntergeladen Boot Mode: Normal ========================================================== ==================== Security Center ======================== ==================== Installed Programs ====================== @BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.30 - GIGABYTE) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.7.148 - Adobe Systems, Inc.) AMD Accelerated Video Transcoding (Version: 13.20.100.31129 - Advanced Micro Devices, Inc.) Hidden AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden AMD Catalyst Control Center (x32 Version: 2013.1129.1143.20969 - Ihr Firmenname) Hidden AMD Catalyst Install Manager (HKLM\...\{853A112F-241F-E344-4636-103C25D3751E}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.) AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden AMD Fuel (Version: 2013.1129.1143.20969 - Ihr Firmenname) Hidden AMD Media Foundation Decoders (Version: 1.0.81129.1203 - Advanced Micro Devices, Inc.) Hidden AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden AutoGreen B12.1220.1 (HKLM-x32\...\InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}) (Version: 1.00.0000 - GIGABYTE) AutoGreen B12.1220.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center InstallProxy (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Standard (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Traditional (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Czech (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Danish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Dutch (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help English (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Finnish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help French (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help German (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Greek (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Hungarian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Italian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Japanese (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Korean (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Norwegian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Polish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Portuguese (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Russian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Spanish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Swedish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Thai (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Turkish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden ccc-utility64 (Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.11 - Piriform) COMODO Internet Security Premium (HKLM\...\{901D1D88-408D-48E5-80DD-CC3145BD8456}) (Version: 6.3.39949.2976 - COMODO Security Solutions Inc.) CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World) Easy Tune 6 B13.1114.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE) Easy Tune 6 B13.1114.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation) EPSON XP-302 303 305 306 Series Printer Uninstall (HKLM\...\EPSON XP-302 303 305 306 Series) (Version: - SEIKO EPSON Corporation) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan) Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle) Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden K-Lite Codec Pack 10.2.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.2.0 - ) Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden ModifyRegistry version 0.1 (HKLM-x32\...\{1D5BE6B5-7FD4-4A78-90F2-AF6B53BC8C1C}_is1) (Version: 0.1 - VIA Technologies, Inc.) Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.4.0 - Mozilla) Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Nero 8 (HKLM-x32\...\{B944FA21-81AF-4A77-8328-CE4F4CC51031}) (Version: 8.10.20 - Nero AG) neroxml (x32 Version: 1.0.0 - Nero AG) Hidden Platform (x32 Version: 1.40 - VIA Technologies, Inc.) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek) Software Updater (HKLM-x32\...\{129C5695-0C85-4D78-827B-6CF2B0155F05}) (Version: 4.2.0 - SEIKO EPSON CORPORATION) <==== ATTENTION Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878234) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{EC1934B0-AE0F-4BBD-8955-54BB3247ED9E}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.40 - VIA Technologies, Inc.) VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN) Winamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) WinRAR (HKLM-x32\...\WinRAR archiver) (Version: - ) ==================== Restore Points ========================= Could not list Restore Points. Check "winmgmt" service or repair WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2014-01-20 19:48 - 00450639 ____R C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 www.1-2005-search.com 127.0.0.1 1-2005-search.com 127.0.0.1 123fporn.info 127.0.0.1 www.123fporn.info 127.0.0.1 123haustiereundmehr.com 127.0.0.1 www.123haustiereundmehr.com 127.0.0.1 123moviedownload.com There are 1000 more lines. ==================== Scheduled Tasks (whitelisted) ============= Task: {08DFE098-8ADC-44A5-9D14-56938F149FA7} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {1CA58105-301F-4593-A6EB-0D4F96BE959F} - System32\Tasks\COMODO\COMODO Welcome {CEB54B45-2B5E-4FF5-9223-6735CD80FE69} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [2013-11-20] (COMODO) Task: {226EC40F-4BF1-4802-8AC5-34347515EC08} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {80C6B135-5372-478E-8C98-5FDFB6E91F5B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-02-20] (Piriform Ltd) Task: {AF65B745-12AD-4D1F-B01C-B14F30748B47} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {B59FCC43-44D8-4A59-9D96-3CC5E1BB7730} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {BC70ACB3-57CF-4F16-B143-90F2F54C0192} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {E61B30EE-32B1-434B-ABC4-81EDBA5F1F6A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated) Task: {EDD3F8E6-4C12-4609-96DC-0F0D40A1E87A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {F11F0E7F-94CE-46C2-93F5-E8082D33C800} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2012-01-13 14:04 - 2012-01-13 14:04 - 00219760 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe 2014-01-15 22:31 - 2012-08-09 11:55 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll 2014-01-15 22:31 - 2012-08-09 11:55 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll 2013-11-29 11:46 - 2013-11-29 11:46 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= Could not list Devices. Check "winmgmt" service or repair WMI. ==================== Event log errors: ========================= Application errors: ================== Error: (03/24/2014 05:23:33 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/24/2014 07:51:19 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/23/2014 01:31:31 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/22/2014 09:02:11 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/22/2014 01:21:56 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/22/2014 11:22:44 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/21/2014 05:47:17 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/21/2014 07:56:09 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/20/2014 07:15:49 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/20/2014 07:42:34 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (03/24/2014 05:24:30 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/24/2014 05:23:32 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Service Component of VO" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/24/2014 05:23:29 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/24/2014 07:52:13 AM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/24/2014 07:51:15 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Service Component of VO" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/24/2014 07:51:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/23/2014 01:32:29 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/23/2014 01:31:30 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Service Component of VO" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/23/2014 01:31:28 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/22/2014 09:03:09 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 30% Total physical RAM: 8156.64 MB Available physical RAM: 5704.7 MB Total Pagefile: 16311.46 MB Available Pagefile: 13521.1 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (Windows) (Fixed) (Total:125 GB) (Free:78.87 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Downloads) (Fixed) (Total:1738.01 GB) (Free:1635.46 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: DA545E6C) Partition: GPT Partition Type. ==================== End Of Log ============================ |
24.03.2014, 19:36 | #2 |
/// TB-Ausbilder | RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dllMein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Schritt 1 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3 Downloade Dir bitte Malwarebytes Anti-Malware
Schritt 4 Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/
Bitte poste mit deiner nächsten Antwort
|
25.03.2014, 08:11 | #3 |
| RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dllCode:
ATTFilter # AdwCleaner v3.022 - Bericht erstellt am 24/03/2014 um 20:03:45 # Aktualisiert 13/03/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Jacky - JACKY-PC # Gestartet von : D:\Heruntergeladen\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : VOsrv ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\IePluginService Ordner Gelöscht : C:\ProgramData\WPM Ordner Gelöscht : C:\Program Files (x86)\Mobogenie Ordner Gelöscht : C:\Program Files (x86)\SupTab Ordner Gelöscht : C:\Users\Jacky\AppData\Local\genienext Ordner Gelöscht : C:\Users\Jacky\AppData\Local\Mobogenie Ordner Gelöscht : C:\Users\Jacky\AppData\Local\SwvUpdater Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\awesomehp Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\newnext.me Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\SupTab Ordner Gelöscht : C:\Users\Jacky\Documents\Mobogenie Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default\Extensions\quick_start@gmail.com ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_start@gmail.com] Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gelöscht : HKLM\Software\supTab ***** [ Browser ] ***** -\\ Internet Explorer v0.0.0.0 Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] -\\ Mozilla Firefox v27.0.1 (de) [ Datei : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default\prefs.js ] Zeile gelöscht : user_pref("accessibility.lightning.homepage", "hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG"); Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.awesomehp.com/newtab/?type=nt&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG"); Zeile gelöscht : user_pref("browser.search.defaultenginename", "awesomehp"); Zeile gelöscht : user_pref("browser.search.selectedEngine", "awesomehp"); Zeile gelöscht : user_pref("extensions.crossrider.bic", "14450b972130a8ea5ce450980b8059bd"); ************************* AdwCleaner[R0].txt - [3981 octets] - [24/03/2014 20:02:50] AdwCleaner[S0].txt - [3342 octets] - [24/03/2014 20:03:45] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3402 octets] ########## Code:
ATTFilter # AdwCleaner v3.022 - Bericht erstellt am 24/03/2014 um 20:03:45 # Aktualisiert 13/03/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Jacky - JACKY-PC # Gestartet von : D:\Heruntergeladen\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : VOsrv ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\IePluginService Ordner Gelöscht : C:\ProgramData\WPM Ordner Gelöscht : C:\Program Files (x86)\Mobogenie Ordner Gelöscht : C:\Program Files (x86)\SupTab Ordner Gelöscht : C:\Users\Jacky\AppData\Local\genienext Ordner Gelöscht : C:\Users\Jacky\AppData\Local\Mobogenie Ordner Gelöscht : C:\Users\Jacky\AppData\Local\SwvUpdater Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\awesomehp Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\newnext.me Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\SupTab Ordner Gelöscht : C:\Users\Jacky\Documents\Mobogenie Ordner Gelöscht : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default\Extensions\quick_start@gmail.com ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_start@gmail.com] Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gelöscht : HKLM\Software\supTab ***** [ Browser ] ***** -\\ Internet Explorer v0.0.0.0 Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] -\\ Mozilla Firefox v27.0.1 (de) [ Datei : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default\prefs.js ] Zeile gelöscht : user_pref("accessibility.lightning.homepage", "hxxp://www.awesomehp.com/?type=hp&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG"); Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.awesomehp.com/newtab/?type=nt&ts=1392923472&from=tugs&uid=ST2000DX001-1CM164_Z1E5RDTGXXXXZ1E5RDTG"); Zeile gelöscht : user_pref("browser.search.defaultenginename", "awesomehp"); Zeile gelöscht : user_pref("browser.search.selectedEngine", "awesomehp"); Zeile gelöscht : user_pref("extensions.crossrider.bic", "14450b972130a8ea5ce450980b8059bd"); ************************* AdwCleaner[R0].txt - [3981 octets] - [24/03/2014 20:02:50] AdwCleaner[S0].txt - [3342 octets] - [24/03/2014 20:03:45] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3402 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.3 (03.23.2014:1) OS: Windows 7 Home Premium x64 Ran by Jacky on 24.03.2014 at 20:10:30,93 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\Jacky\AppData\Roaming\mozilla\firefox\profiles\7ckz5xqb.default\minidumps [10 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 24.03.2014 at 20:48:09,79 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 24.03.2014 Suchlauf-Zeit: 21:11:56 Logdatei: test.txt Administrator: Ja Version: 2.00.0.1000 Malware Datenbank: v2014.03.24.08 Rootkit Datenbank: v2014.03.18.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Jacky Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 242130 Verstrichene Zeit: 18 Min, 3 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 2 PUP.Optional.Awesomehp.A, HKLM\SOFTWARE\WOW6432NODE\awesomehpSoftware, In Quarantäne, [11079d6a9dde0c2a9b4690ccd929857b], PUP.Optional.FevenPro.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Feven Pro 1.2, In Quarantäne, [0513a463304b8caa3330a6b4a35fd927], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 1 PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[a4743ec9215ada5c563e758c3dc70000] Ordner: 0 (No malicious items detected) Dateien: 1 PUP.Optional.Awesomehp.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\awesomehp.xml, In Quarantäne, [52c67c8bfe7d76c0bdff2c30020009f7], Physische Sektoren: 0 (No malicious items detected) (end) Und Zoek da kann ich nichts einfügen, dauert ewig bis sich etwas öffnet, dann kommt ein Fenster und direkt daraufhin geht das Log File auf mit folgendem Inhalt: ==== Older Logs ====================== C:\zoek-results2014-03-24-201344.log 237 bytes ==== System Restore Info ====================== Failed to create System Restore Point ==== C:\zoek_backup content ====================== C:\zoek_backup (files=0 folders=0 0 bytes) ==== EOF on 24.03.2014 at 21:14:31,27 ====================== ==== C:\zoek_backup content ====================== C:\zoek_backup (files=0 folders=0 0 bytes) ==== EOF on 24.03.2014 at 21:15:16,48 ====================== Oder hab ich etwas falsch gemacht ? |
25.03.2014, 20:29 | #4 |
/// TB-Ausbilder | RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Servus, Wir spüren die letzten Reste auf, damit wir sie später entfernen können: Schritt 1 Kontrollscan mit FRST Führe wie zuvor beschrieben einen Scan mit FRST aus. Setze dazu einen Haken bei Addition.txt rechts unten und klicke auf Scan. Es werden zwei Logdateien erzeugt. Poste mir diese. Schritt 2 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Gibt es noch Probleme mit Malware? Wenn ja, welche? Wie läuft der Rechner derzeit? Bitte poste mit deiner nächsten Antwort
|
25.03.2014, 20:57 | #5 |
| RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Probleme macht der Rechner soweit keine, hat er aber vorher auch nicht.. Was meinst du genau ? FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Jacky (administrator) on JACKY-PC on 25-03-2014 20:49:28 Running from D:\Heruntergeladen Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= () C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIKE.EXE (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIKE.EXE (Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [COMODO Internet Security] - C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1612504 2013-11-11] (COMODO) HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5263504 2012-08-09] (VIA) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-29] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) HKLM-x32\...\RunOnce: [EasyTuneVI] - C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] () Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe [202024 2007-09-20] (Nero AG) HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\MountPoints2: {793c3345-7ed0-11e3-a52f-74d43502932a} - G:\SETUP.EXE HKU\S-1-5-21-1800813360-1220724965-2459123699-1000\...\MountPoints2: {bb098fe1-7e1d-11e3-ba28-806e6f6e6963} - E:\Run.exe ==================== Internet (Whitelisted) ==================== Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\7ckz5xqb.default FF Homepage: www.google.de FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jacky\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-11-29] (Advanced Micro Devices, Inc.) R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6254152 2013-10-20] (COMODO) S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [164056 2013-09-24] (COMODO) R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation) R3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [382248 2007-09-20] (Nero AG) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-03] (VIA Technologies, Inc.) ==================== Drivers (Whitelisted) ==================== R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices) R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-09-24] (COMODO) R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [709144 2013-11-14] (COMODO) R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [48872 2013-09-24] (COMODO) R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2014-03-25] () R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [96800 2013-09-24] (COMODO) R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [231112 2013-01-03] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [301256 2013-01-03] (VIA Technologies, Inc.) S2 ASInsHelp; \??\C:\Windows\SysWow64\drivers\AsInsHelp64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-25 20:47 - 2014-03-25 20:49 - 00000000 ____D () C:\FRST 2014-03-25 17:48 - 2014-03-25 17:52 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-24 21:13 - 2014-03-24 21:13 - 00000000 ____D () C:\Windows\SysWOW64\zoek 2014-03-24 20:51 - 2014-03-25 18:33 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-24 20:51 - 2014-03-24 20:51 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-24 20:50 - 2014-03-24 20:51 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-24 20:50 - 2014-03-24 20:50 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-24 20:50 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-24 20:50 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-24 20:50 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-24 20:06 - 2014-03-24 20:06 - 00000000 ____D () C:\Windows\ERUNT 2014-03-24 17:23 - 2014-03-25 20:45 - 00000560 _____ () C:\Windows\setupact.log 2014-03-24 17:23 - 2014-03-24 17:23 - 00000000 _____ () C:\Windows\setuperr.log 2014-03-24 07:56 - 2014-03-24 08:01 - 00000000 ____D () C:\Program Files (x86)\Advanced Fix 2014 2014-03-19 07:50 - 2014-03-19 23:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-03-12 20:59 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-12 20:59 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-12 20:59 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-12 20:59 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-12 20:59 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-12 20:59 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-12 20:59 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-12 20:59 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-05 18:23 - 2014-03-05 18:23 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\EPSON 2014-02-26 18:02 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-02-26 18:02 - 2014-01-03 23:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-02-24 22:21 - 2014-02-24 22:21 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2014-02-23 21:41 - 2014-02-23 21:44 - 00000069 _____ () C:\Windows\NeroDigital.ini 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\Nero 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Local\Ahead 2014-02-23 19:46 - 2014-02-23 19:46 - 00000188 _____ () C:\Windows\SysWOW64\MsiExec.exe.log 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\ProgramData\Nero 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\Program Files (x86)\Nero 2014-02-23 19:43 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll 2014-02-23 19:43 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll ==================== One Month Modified Files and Folders ======= 2014-03-25 20:49 - 2014-03-25 20:47 - 00000000 ____D () C:\FRST 2014-03-25 20:48 - 2014-01-15 20:50 - 01680281 _____ () C:\Windows\WindowsUpdate.log 2014-03-25 20:45 - 2014-03-24 17:23 - 00000560 _____ () C:\Windows\setupact.log 2014-03-25 20:45 - 2014-02-02 17:03 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref 2014-03-25 20:45 - 2014-01-15 22:18 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys 2014-03-25 20:45 - 2014-01-15 21:14 - 00030528 _____ () C:\Windows\GVTDrv64.sys 2014-03-25 20:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-25 20:44 - 2014-01-15 20:59 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat 2014-03-25 20:43 - 2014-01-15 21:39 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-25 18:46 - 2009-07-14 05:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-25 18:46 - 2009-07-14 05:45 - 00025840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-25 18:45 - 2014-01-16 05:44 - 00699092 _____ () C:\Windows\system32\perfh007.dat 2014-03-25 18:45 - 2014-01-16 05:44 - 00149232 _____ () C:\Windows\system32\perfc007.dat 2014-03-25 18:45 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-25 18:33 - 2014-03-24 20:51 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-25 17:52 - 2014-03-25 17:48 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-24 21:13 - 2014-03-24 21:13 - 00000000 ____D () C:\Windows\SysWOW64\zoek 2014-03-24 20:51 - 2014-03-24 20:51 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-24 20:51 - 2014-03-24 20:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-03-24 20:51 - 2014-01-15 21:57 - 00000000 ____D () C:\Users\Jacky\Desktop\Tools 2014-03-24 20:50 - 2014-03-24 20:50 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-24 20:06 - 2014-03-24 20:06 - 00000000 ____D () C:\Windows\ERUNT 2014-03-24 17:23 - 2014-03-24 17:23 - 00000000 _____ () C:\Windows\setuperr.log 2014-03-24 08:11 - 2014-01-15 21:21 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\Winamp 2014-03-24 08:09 - 2014-01-15 20:50 - 00000000 ____D () C:\Users\Jacky 2014-03-24 08:01 - 2014-03-24 07:56 - 00000000 ____D () C:\Program Files (x86)\Advanced Fix 2014 2014-03-24 08:00 - 2014-02-14 17:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-03-24 08:00 - 2014-01-16 19:14 - 00000000 ____D () C:\Program Files\CCleaner 2014-03-20 07:42 - 2014-01-16 18:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-19 23:53 - 2014-03-19 07:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-03-15 15:28 - 2014-01-20 14:20 - 00000000 ____D () C:\Users\Jacky\Desktop\Ebay 2014-03-13 07:34 - 2009-07-14 05:45 - 00342152 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-13 07:33 - 2014-01-16 20:17 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-13 07:33 - 2014-01-16 20:17 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-12 21:03 - 2014-01-15 21:19 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-12 21:01 - 2014-01-16 18:16 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-03-12 21:01 - 2014-01-15 21:19 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-03-12 10:43 - 2014-01-15 21:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-12 10:43 - 2014-01-15 21:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-12 10:43 - 2014-01-15 21:39 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-08 14:14 - 2014-01-20 16:51 - 00000000 ____D () C:\Users\Jacky\AppData\Local\Unity 2014-03-05 18:23 - 2014-03-05 18:23 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\EPSON 2014-03-05 09:26 - 2014-03-24 20:50 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-05 09:26 - 2014-03-24 20:50 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-05 09:26 - 2014-03-24 20:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-05 06:42 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-04 20:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-28 19:42 - 2014-01-16 20:03 - 00000467 _____ () C:\Windows\wiso.ini 2014-02-28 19:40 - 2014-01-16 20:01 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH 2014-02-24 22:21 - 2014-02-24 22:21 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2014-02-23 21:44 - 2014-02-23 21:41 - 00000069 _____ () C:\Windows\NeroDigital.ini 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Roaming\Nero 2014-02-23 19:50 - 2014-02-23 19:50 - 00000000 ____D () C:\Users\Jacky\AppData\Local\Ahead 2014-02-23 19:46 - 2014-02-23 19:46 - 00000188 _____ () C:\Windows\SysWOW64\MsiExec.exe.log 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\ProgramData\Nero 2014-02-23 19:45 - 2014-02-23 19:45 - 00000000 ____D () C:\Program Files (x86)\Nero 2014-02-23 19:45 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors Some content of TEMP: ==================== C:\Users\Jacky\AppData\Local\Temp\7za.exe C:\Users\Jacky\AppData\Local\Temp\hijackthis.exe C:\Users\Jacky\AppData\Local\Temp\NirCmd.exe C:\Users\Jacky\AppData\Local\Temp\PEVZ.EXE C:\Users\Jacky\AppData\Local\Temp\Quarantine.exe C:\Users\Jacky\AppData\Local\Temp\remove.exe C:\Users\Jacky\AppData\Local\Temp\sed.exe C:\Users\Jacky\AppData\Local\Temp\shortcut.exe C:\Users\Jacky\AppData\Local\Temp\swreg.exe C:\Users\Jacky\AppData\Local\Temp\swxcacls.exe C:\Users\Jacky\AppData\Local\Temp\wget.exe C:\Users\Jacky\AppData\Local\Temp\zoek-delete.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-21 18:35 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 Ran by Jacky at 2014-03-25 20:49:54 Running from D:\Heruntergeladen Boot Mode: Normal ========================================================== ==================== Security Center ======================== ==================== Installed Programs ====================== @BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.30 - GIGABYTE) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.7.148 - Adobe Systems, Inc.) AMD Accelerated Video Transcoding (Version: 13.20.100.31129 - Advanced Micro Devices, Inc.) Hidden AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden AMD Catalyst Control Center (x32 Version: 2013.1129.1143.20969 - Ihr Firmenname) Hidden AMD Catalyst Install Manager (HKLM\...\{853A112F-241F-E344-4636-103C25D3751E}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.) AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden AMD Fuel (Version: 2013.1129.1143.20969 - Ihr Firmenname) Hidden AMD Media Foundation Decoders (Version: 1.0.81129.1203 - Advanced Micro Devices, Inc.) Hidden AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden AutoGreen B12.1220.1 (HKLM-x32\...\InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}) (Version: 1.00.0000 - GIGABYTE) AutoGreen B12.1220.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center InstallProxy (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Standard (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Traditional (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Czech (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Danish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Dutch (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help English (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Finnish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help French (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help German (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Greek (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Hungarian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Italian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Japanese (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Korean (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Norwegian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Polish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Portuguese (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Russian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Spanish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Swedish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Thai (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden CCC Help Turkish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden ccc-utility64 (Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.11 - Piriform) COMODO Internet Security Premium (HKLM\...\{901D1D88-408D-48E5-80DD-CC3145BD8456}) (Version: 6.3.39949.2976 - COMODO Security Solutions Inc.) CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World) Easy Tune 6 B13.1114.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE) Easy Tune 6 B13.1114.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation) EPSON XP-302 303 305 306 Series Printer Uninstall (HKLM\...\EPSON XP-302 303 305 306 Series) (Version: - SEIKO EPSON Corporation) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan) Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle) Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden K-Lite Codec Pack 10.2.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.2.0 - ) Malwarebytes Anti-Malware Version 2.00.0.1000 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.00.0.1000 - Malwarebytes Corporation) Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden ModifyRegistry version 0.1 (HKLM-x32\...\{1D5BE6B5-7FD4-4A78-90F2-AF6B53BC8C1C}_is1) (Version: 0.1 - VIA Technologies, Inc.) Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.4.0 - Mozilla) Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Nero 8 (HKLM-x32\...\{B944FA21-81AF-4A77-8328-CE4F4CC51031}) (Version: 8.10.20 - Nero AG) neroxml (x32 Version: 1.0.0 - Nero AG) Hidden Platform (x32 Version: 1.40 - VIA Technologies, Inc.) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878234) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{EC1934B0-AE0F-4BBD-8955-54BB3247ED9E}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.40 - VIA Technologies, Inc.) VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN) Winamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc) Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc) WinRAR (HKLM-x32\...\WinRAR archiver) (Version: - ) ==================== Restore Points ========================= Could not list Restore Points. Check "winmgmt" service or repair WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2014-01-20 19:48 - 00450639 ____R C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 www.1-2005-search.com 127.0.0.1 1-2005-search.com 127.0.0.1 123fporn.info 127.0.0.1 www.123fporn.info 127.0.0.1 123haustiereundmehr.com 127.0.0.1 www.123haustiereundmehr.com 127.0.0.1 123moviedownload.com There are 1000 more lines. ==================== Scheduled Tasks (whitelisted) ============= Task: {08DFE098-8ADC-44A5-9D14-56938F149FA7} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {1CA58105-301F-4593-A6EB-0D4F96BE959F} - System32\Tasks\COMODO\COMODO Welcome {CEB54B45-2B5E-4FF5-9223-6735CD80FE69} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [2013-11-20] (COMODO) Task: {226EC40F-4BF1-4802-8AC5-34347515EC08} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {80C6B135-5372-478E-8C98-5FDFB6E91F5B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-02-20] (Piriform Ltd) Task: {AF65B745-12AD-4D1F-B01C-B14F30748B47} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {B59FCC43-44D8-4A59-9D96-3CC5E1BB7730} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {BC70ACB3-57CF-4F16-B143-90F2F54C0192} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO) Task: {E61B30EE-32B1-434B-ABC4-81EDBA5F1F6A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated) Task: {EDD3F8E6-4C12-4609-96DC-0F0D40A1E87A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {F11F0E7F-94CE-46C2-93F5-E8082D33C800} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2012-01-13 14:04 - 2012-01-13 14:04 - 00219760 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe 2014-01-15 22:31 - 2012-08-09 11:55 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll 2014-01-15 22:31 - 2012-08-09 11:55 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll 2013-11-29 11:46 - 2013-11-29 11:46 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= Could not list Devices. Check "winmgmt" service or repair WMI. ==================== Event log errors: ========================= Application errors: ================== Error: (03/25/2014 08:45:07 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/25/2014 06:38:58 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/25/2014 06:33:13 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/25/2014 05:40:57 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/25/2014 07:40:37 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/24/2014 09:20:17 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (03/25/2014 08:46:06 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/25/2014 08:45:05 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/25/2014 06:39:57 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/25/2014 06:38:56 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/25/2014 06:34:12 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/25/2014 06:33:11 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/25/2014 05:41:55 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/25/2014 05:40:54 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (03/25/2014 07:41:32 AM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (03/25/2014 07:40:31 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "ASInsHelp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 22% Total physical RAM: 8156.64 MB Available physical RAM: 6304.7 MB Total Pagefile: 16311.46 MB Available Pagefile: 14194.05 MB Total Virtual: 8192 MB Available Virtual: 8191.84 MB ==================== Drives ================================ Drive c: (Windows) (Fixed) (Total:125 GB) (Free:80.08 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Downloads) (Fixed) (Total:1738.01 GB) (Free:1635.44 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: DA545E6C) Partition: GPT Partition Type. ==================== End Of Log ============================ Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff Log created at 20:52 on 25/03/2014 by Jacky Administrator - Elevation successful ========== regfind ========== Searching for "awesomehp" No data found. Searching for "VOPackage" No data found. -= EOF =- |
25.03.2014, 21:01 | #6 |
/// TB-Ausbilder | RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Servus, kommt die Fehlermeldung immer noch? |
25.03.2014, 21:10 | #7 |
| RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Hey, fast vergessen Die kam schon nach dem ersten run nicht mehr.. Vielen Dank !! Was würdest du denn sagen, wie sieht es aus in meinem System ? |
26.03.2014, 20:38 | #8 |
/// TB-Ausbilder | RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Servus, sieht gut aus. Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern. Im Anschluss daran räumen wir auf und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
Schritt 2 ESET Online Scanner
Schritt 3 Downloade Dir bitte SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
27.03.2014, 00:31 | #9 |
| RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dllCode:
ATTFilter
Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=f6054016a01c4a47a41edc4cb5db4782 # engine=17636 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-03-26 11:24:59 # local_time=2014-03-27 12:24:59 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=3074 16777213 100 84 24186 29832339 0 0 # compatibility_mode=5893 16776574 100 94 5970052 147506149 0 0 # scanned=108192 # found=0 # cleaned=0 # scan_time=9129 Code:
ATTFilter Results of screen317's Security Check version 0.99.80 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` MVPS Hosts File Spybot - Search & Destroy Java 7 Update 51 Adobe Flash Player 12.0.0.77 Adobe Reader XI Mozilla Firefox (27.0.1) Mozilla Thunderbird (24.4.0) ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
27.03.2014, 20:25 | #10 |
/// TB-Ausbilder | RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Servus, Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber. Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1 Die Reihenfolge ist hier entscheidend.
Schritt 2 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
27.03.2014, 21:32 | #11 |
| RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Vielen Dank für Alles !!!!!! Sag mal meine comodo Software ist das ok die zu benutzen ? Sonst habe ich eigentlich noch den CCleaner drauf, sollte ich den besser nicht benutzen ? Ansonsten habe ich aber keine Probleme mehr. Kannst es also aus dem Abo rausnehmen |
27.03.2014, 21:57 | #12 | |
/// TB-Ausbilder | RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll Ja, ist ok. Zitat:
Ich bin froh, dass wir helfen konnten In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
Themen zu RunDll Fehler C:\Users\Jacky\AppData\Roaming\newnext.me\nengine.dll |
.dll, administrator, adobe flash player, awesomehp, awesomehp entfernen, branding, desktop, dll, explorer, firefox, flash player, homepage, mobogenie, mobogenie entfernen, newtab, nextlive, pup.optional.awesomehp.a, pup.optional.fevenpro.a, pup.optional.qone8, quick_start, refresh, rundll, scan, services.exe, software, svchost.exe, system, winlogon.exe |