| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bin auf Spyhunter 4 und Optimizer Pro reingefallenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
30.04.2014, 05:50
| #5 |
 |  Bin auf Spyhunter 4 und Optimizer Pro reingefallenCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-04-2014
Ran by Shenyu at 2014-04-30 01:22:56 Run:1
Running from C:\Users\Shenyu\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
U4 EsgScanner; system32\DRIVERS\EsgScanner.sys [X]
2014-04-27 23:36 - 2014-04-27 23:36 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-27 23:36 - 2014-04-27 23:36 - 00000000 _____ () C:\autoexec.bat
2014-04-27 23:31 - 2014-04-27 23:31 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Shenyu\Downloads\SpyHunter-Installer.exe
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS
*****************
EsgScanner => Service deleted successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
C:\autoexec.bat => Moved successfully.
C:\Users\Shenyu\Downloads\SpyHunter-Installer.exe => Moved successfully.
C:\ProgramData\SetStretch.exe => Moved successfully.
C:\ProgramData\SetStretch.VBS => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter # AdwCleaner v3.205 - Bericht erstellt am 30/04/2014 um 01:31:06
# Aktualisiert 28/04/2014 von Xplode
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Shenyu - AMY
# Gestartet von : C:\Users\Shenyu\Downloads\adwcleaner (1).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro
Ordner Gelöscht : C:\Users\Shenyu\AppData\Local\Temp\WiseEnhance
Ordner Gelöscht : C:\Users\Shenyu\Documents\Optimizer Pro
Datei Gelöscht : C:\Users\Shenyu\AppData\Roaming\Mozilla\Firefox\Profiles\ba09ct8m.default\searchplugins\Mysearchdial.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{392DE650-A1E6-4FB3-A5A4-21285DE225BD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{318A227B-5E9F-45BD-8999-7F8F10CA4CF5}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiseEnhance
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16518
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\Users\Shenyu\AppData\Roaming\Mozilla\Firefox\Profiles\ba09ct8m.default\prefs.js ]
-\\ Google Chrome v34.0.1847.116
[ Datei : C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Startup_urls] : hxxp://start.mysearchdial.com/?f=1&a=frmr_14_17_ff&cd=2XzuyEtN2Y1L1QzuyByE0DtDtB0ByEyE0ByByByByCtAtA0BtN0D0Tzu0SzzyEzztN1L2XzutBtFtBtDtFyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCzz0EyByD0A0DyDtG0B0CtCyDtG0E0EyByCtG0ByEyDtAtGtCyByCyC0DtD0CtAtA0Dzz0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2StD0BtDtCyEyDtByCtGyB0F0C0CtG0B0C0AzytGyEtDtC0BtGtDtAyD0E0BtDzzyEtBtDtD0B2Q&cr=1969315433&ir=
Gelöscht [Homepage] : hxxp://start.mysearchdial.com/?f=1&a=frmr_14_17_ff&cd=2XzuyEtN2Y1L1QzuyByE0DtDtB0ByEyE0ByByByByCtAtA0BtN0D0Tzu0SzzyEzztN1L2XzutBtFtBtDtFyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCzz0EyByD0A0DyDtG0B0CtCyDtG0E0EyByCtG0ByEyDtAtGtCyByCyC0DtD0CtAtA0Dzz0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2StD0BtDtCyEyDtByCtGyB0F0C0CtG0B0C0AzytGyEtDtC0BtGtDtAyD0E0BtDzzyEtBtDtD0B2Q&cr=1969315433&ir=
*************************
AdwCleaner[R0].txt - [8612 octets] - [05/12/2013 02:10:45]
AdwCleaner[R1].txt - [6562 octets] - [30/04/2014 01:29:41]
AdwCleaner[S0].txt - [8164 octets] - [05/12/2013 02:11:41]
AdwCleaner[S1].txt - [5905 octets] - [30/04/2014 01:31:06]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5965 octets] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 30.04.2014 Suchlauf-Zeit: 02:25:10 Logdatei: mbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.29.09 Rootkit Datenbank: v2014.03.27.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Chameleon: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Shenyu Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 253613 Verstrichene Zeit: 43 Min, 4 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 2 PUP.Optional.BrowseSmart.A, C:\Users\Shenyu\AppData\Roaming\Mozilla\Firefox\Profiles\ba09ct8m.default\extensions\firefox@browsesmart.net.xpi, In Quarantäne, [c43cda2625dbc13f2a6095e8ff03738d], PUP.Optional.MySearchDial.A, C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "search_url": "hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=frmr_14_17_ff&cd=2XzuyEtN2Y1L1QzuyByE0DtDtB0ByEyE0ByByByByCtAtA0BtN0D0Tzu0SzzyEzztN1L2XzutBtFtBtDtFyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCzz0EyByD0A0DyDtG0B0CtCyDtG0E0EyByCtG0ByEyDtAtGtCyByCyC0DtD0CtAtA0Dzz0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2StD0BtDtCyEyDtByCtGyB0F0C0CtG0B0C0AzytGyEtDtC0BtGtDtAyD0E0BtDzzyEtBtDtD0B2Q&cr=1969315433&ir=",), Ersetzt,[56aab74941bf48b8922aa1beef153ac6] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=89ff6e68e2f646409bd24ae21487d06b
# engine=18081
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-30 01:24:16
# local_time=2014-04-30 03:24:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode=774 16777213 71 76 187424 188109 0 0
# compatibility_mode=5893 16776574 100 94 187742 3826996 0 0
# scanned=185888
# found=1
# cleaned=0
# scan_time=3004
sh=FAF984F50CD4F7B061339F1EB411B3B8EFFAAD5A ft=1 fh=c71c00112d7f51a9 vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Users\Shenyu\Downloads\DownloadAcceleratorSetup.exe"
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2014
Ran by Shenyu (administrator) on AMY on 30-04-2014 06:42:19
Running from C:\Users\Shenyu\Downloads
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(Microsoft Corporation) C:\Windows\System32\skydrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHAE.EXE
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Comfort Software Group) C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20461_x64__8wekyb3d8bbwe\LiveComm.exe
(Farbar) C:\Users\Shenyu\Downloads\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)
HKLM\...\Run: [ACMON] => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-09-11] (ASUS)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2012-11-27] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe [3423104 2012-08-31] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-27] (AVAST Software)
HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\AVAST Software\Avast\setup\emupdate\01ac3e64-ae36-44e0-bb03-28d9b0d517b7.exe /check [181136 2014-04-30] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1943263773-1832819459-690236666-1001\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1943263773-1832819459-690236666-1001\...\Run: [FreeAC] => C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe [1339672 2013-11-04] (Comfort Software Group)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites&cd=2XzuyEtN2Y1L1QzuyByE0DtDtB0ByEyE0ByByByByCtAtA0BtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=47435445&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites&cd=2XzuyEtN2Y1L1QzuyByE0DtDtB0ByEyE0ByByByByCtAtA0BtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=47435445&ir=
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Shenyu\AppData\Roaming\Mozilla\Firefox\Profiles\ba09ct8m.default
FF DefaultSearchEngine: Yahoo! (Avast)
FF SearchEngineOrder.1: Yahoo! (Avast)
FF SelectedSearchEngine: Yahoo! (Avast)
FF Homepage: hxxp://de.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type=avastbcl
FF Keyword.URL: hxxp://de.yhs4.search.yahoo.com/yhs/search
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Shenyu\AppData\Roaming\Mozilla\Firefox\Profiles\ba09ct8m.default\searchplugins\yahoo-avast.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-05]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR DefaultSearchKeyword: mysearchdial.com
CHR DefaultSearchProvider: Mysearchdial
CHR DefaultSearchURL: hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=frmr_14_17_ff&cd=2XzuyEtN2Y1L1QzuyByE0DtDtB0ByEyE0ByByByByCtAtA0BtN0D0Tzu0SzzyEzztN1L2XzutBtFtBtDtFyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyCzz0EyByD0A0DyDtG0B0CtCyDtG0E0EyByCtG0ByEyDtAtGtCyByCyC0DtD0CtAtA0Dzz0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2StD0BtDtCyEyDtByCtGyB0F0C0CtG0B0C0AzytGyEtDtC0BtGtDtAyD0E0BtDzzyEtBtDtD0B2Q&cr=1969315433&ir=
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-08]
CHR Extension: (Google Drive) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-08]
CHR Extension: (YouTube) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-08]
CHR Extension: (Google-Suche) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-08]
CHR Extension: (SPOTS - A better way to start) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejocekekgcaldnmjngfdbmbeebcekelc [2014-04-27]
CHR Extension: (avast! Online Security) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-30]
CHR Extension: (Google Wallet) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-08]
CHR Extension: (Google Mail) - C:\Users\Shenyu\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-08]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-27]
==================== Services (Whitelisted) =================
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-27] (AVAST Software)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2014-03-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-16] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-27] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-27] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-04-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-27] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2014-03-16] (Microsoft Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2014-03-16] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-14] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2014-03-16] (Microsoft Corporation)
R1 {2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64; C:\Windows\System32\drivers\{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys [61120 2014-04-24] (StdLib)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-30 06:31 - 2014-04-30 06:31 - 00003914 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{99218FB4-98D7-4A0D-8E7F-E02619DB1815}
2014-04-30 02:29 - 2014-04-30 02:30 - 02347384 _____ (ESET) C:\Users\Shenyu\Downloads\esetsmartinstaller_deu.exe
2014-04-30 02:27 - 2014-04-30 02:27 - 00001897 _____ () C:\Users\Shenyu\Desktop\mbam.txt
2014-04-30 01:39 - 2014-04-30 01:42 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-04-30 01:38 - 2014-04-30 01:38 - 00001116 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-30 01:38 - 2014-04-30 01:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-30 01:38 - 2014-04-30 01:38 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-30 01:38 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-04-30 01:38 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-04-30 01:38 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-04-30 01:37 - 2014-04-30 01:37 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Shenyu\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-30 01:34 - 2014-04-30 01:34 - 00006129 _____ () C:\Users\Shenyu\Desktop\AdwCleaner[S1].txt
2014-04-30 01:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll
2014-04-30 01:29 - 2014-04-30 01:29 - 01310621 _____ () C:\Users\Shenyu\Downloads\adwcleaner (1).exe
2014-04-29 02:51 - 2014-04-29 02:51 - 02061824 _____ (Farbar) C:\Users\Shenyu\Downloads\FRST64 (2).exe
2014-04-29 02:41 - 2014-04-29 02:41 - 02061824 _____ (Farbar) C:\Users\Shenyu\Downloads\FRST64 (1).exe
2014-04-27 23:50 - 2014-04-27 23:50 - 00003316 _____ () C:\WINDOWS\System32\Tasks\{6B43C8E7-D590-4D42-9AEB-FB4AB25E3B80}
2014-04-27 23:47 - 2014-04-29 02:41 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\Nico Mak Computing
2014-04-27 23:46 - 2014-04-27 23:47 - 04892480 _____ (WinZip International LLC ) C:\Users\Shenyu\Downloads\wzmp_8.exe
2014-04-27 23:36 - 2014-04-27 23:37 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\DropboxMaster
2014-04-27 23:35 - 2014-04-27 23:35 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-27 23:34 - 2014-04-27 23:37 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\Dropbox
2014-04-27 23:33 - 2014-04-27 23:52 - 00000000 ____D () C:\WINDOWS\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-04-27 23:09 - 2014-04-27 23:09 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-04-27 23:09 - 2014-04-27 23:09 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-04-27 22:28 - 2014-04-24 12:32 - 00061120 _____ (StdLib) C:\WINDOWS\system32\Drivers\{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys
2014-04-27 20:54 - 2014-04-27 20:53 - 01376768 _____ () C:\Users\Shenyu\Downloads\7-zip-64-bit.msi
2014-04-27 20:45 - 2014-04-27 20:45 - 00017510 _____ () C:\Users\Shenyu\Downloads\The.Originals.S01E19.720p.HDTV.X264-DIMENSION.de-SubCentral.rar
2014-04-14 18:21 - 2014-04-14 18:21 - 00022798 _____ () C:\Users\Shenyu\Downloads\Unbenannt 1.odt
2014-04-14 18:08 - 2011-04-20 03:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\WINDOWS\system32\SET7F26.tmp
2014-04-14 18:08 - 2011-03-15 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\WINDOWS\system32\E_ID4BHAE.DLL
2014-04-14 18:08 - 2007-04-10 01:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\WINDOWS\system32\E_GCINST.DLL
2014-04-14 18:03 - 2008-11-11 18:00 - 00118784 ____N (SEIKO EPSON CORPORATION) C:\WINDOWS\system32\E_ILMHAE.DLL
2014-04-14 18:01 - 2014-04-14 18:20 - 00022798 _____ () C:\Users\Shenyu\Documents\Unbenannt 1.odt
2014-04-09 08:17 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-04-09 08:17 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-04-09 08:17 - 2014-03-10 12:35 - 02008408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-04-09 08:17 - 2014-03-10 12:35 - 00377176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2014-04-09 08:17 - 2014-03-06 11:19 - 01287576 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-04-09 08:17 - 2014-03-06 11:02 - 01109424 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-04-09 08:17 - 2014-03-06 08:17 - 00835584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-04-09 08:17 - 2014-03-06 08:10 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-04-09 08:11 - 2014-04-09 08:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-04-09 08:11 - 2014-04-09 08:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
==================== One Month Modified Files and Folders =======
2014-04-30 06:42 - 2013-12-02 01:11 - 00015163 _____ () C:\Users\Shenyu\Downloads\FRST.txt
2014-04-30 06:42 - 2013-12-02 01:11 - 00000000 ____D () C:\FRST
2014-04-30 06:31 - 2014-04-30 06:31 - 00003914 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{99218FB4-98D7-4A0D-8E7F-E02619DB1815}
2014-04-30 06:16 - 2014-01-08 02:54 - 00001118 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-30 06:09 - 2013-08-15 14:11 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-04-30 06:00 - 2014-03-16 21:50 - 01153548 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-30 06:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-04-30 03:24 - 2013-08-10 21:36 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1943263773-1832819459-690236666-1001
2014-04-30 02:30 - 2014-04-30 02:29 - 02347384 _____ (ESET) C:\Users\Shenyu\Downloads\esetsmartinstaller_deu.exe
2014-04-30 02:27 - 2014-04-30 02:27 - 00001897 _____ () C:\Users\Shenyu\Desktop\mbam.txt
2014-04-30 01:42 - 2014-04-30 01:39 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-04-30 01:38 - 2014-04-30 01:38 - 00001116 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-30 01:38 - 2014-04-30 01:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-04-30 01:38 - 2014-04-30 01:38 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-30 01:38 - 2013-12-05 01:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-30 01:38 - 2013-11-14 09:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-04-30 01:38 - 2013-11-14 09:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-04-30 01:38 - 2013-11-14 09:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-04-30 01:37 - 2014-04-30 01:37 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Shenyu\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-30 01:35 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp
2014-04-30 01:34 - 2014-04-30 01:34 - 00006129 _____ () C:\Users\Shenyu\Desktop\AdwCleaner[S1].txt
2014-04-30 01:34 - 2014-03-16 22:27 - 00000000 __RDO () C:\Users\Shenyu\SkyDrive
2014-04-30 01:34 - 2014-01-08 02:54 - 00001114 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-30 01:33 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-04-30 01:33 - 2013-08-10 21:31 - 00000416 _____ () C:\Users\Shenyu\AppData\Roaming\sp_data.sys
2014-04-30 01:32 - 2013-11-14 00:18 - 00070970 _____ () C:\WINDOWS\PFRO.log
2014-04-30 01:32 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-04-30 01:31 - 2013-12-05 02:10 - 00000000 ____D () C:\AdwCleaner
2014-04-30 01:29 - 2014-04-30 01:29 - 01310621 _____ () C:\Users\Shenyu\Downloads\adwcleaner (1).exe
2014-04-29 05:47 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-04-29 03:10 - 2013-08-15 14:11 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-04-29 02:55 - 2013-12-02 01:11 - 00026038 _____ () C:\Users\Shenyu\Downloads\Addition.txt
2014-04-29 02:51 - 2014-04-29 02:51 - 02061824 _____ (Farbar) C:\Users\Shenyu\Downloads\FRST64 (2).exe
2014-04-29 02:41 - 2014-04-29 02:41 - 02061824 _____ (Farbar) C:\Users\Shenyu\Downloads\FRST64 (1).exe
2014-04-29 02:41 - 2014-04-27 23:47 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\Nico Mak Computing
2014-04-27 23:52 - 2014-04-27 23:33 - 00000000 ____D () C:\WINDOWS\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-04-27 23:50 - 2014-04-27 23:50 - 00003316 _____ () C:\WINDOWS\System32\Tasks\{6B43C8E7-D590-4D42-9AEB-FB4AB25E3B80}
2014-04-27 23:47 - 2014-04-27 23:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Shenyu\Downloads\wzmp_8.exe
2014-04-27 23:37 - 2014-04-27 23:36 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\DropboxMaster
2014-04-27 23:37 - 2014-04-27 23:34 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\Dropbox
2014-04-27 23:35 - 2014-04-27 23:35 - 00000000 ____D () C:\Users\Shenyu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-27 23:24 - 2013-08-12 11:11 - 00001137 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-04-27 23:15 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-04-27 23:10 - 2013-12-06 17:46 - 00002041 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-04-27 23:10 - 2012-11-27 06:08 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-04-27 23:09 - 2014-04-27 23:09 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-04-27 23:09 - 2014-04-27 23:09 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-04-27 23:09 - 2014-01-07 12:49 - 00085328 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys
2014-04-27 23:09 - 2013-12-05 02:48 - 01039096 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2014-04-27 23:09 - 2013-12-05 02:48 - 00423240 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-04-27 23:09 - 2013-12-05 02:48 - 00334648 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-04-27 23:09 - 2013-12-05 02:48 - 00208416 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-04-27 23:09 - 2013-12-05 02:48 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-04-27 23:09 - 2013-12-05 02:48 - 00079184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-04-27 23:09 - 2013-12-05 02:48 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-04-27 23:09 - 2013-12-05 02:48 - 00003924 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-04-27 23:09 - 2013-12-05 02:48 - 00001984 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-27 23:05 - 2012-07-26 07:26 - 00000226 _____ () C:\WINDOWS\win.ini
2014-04-27 21:28 - 2014-03-16 21:33 - 00000000 ____D () C:\Users\Shenyu
2014-04-27 21:09 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2014-04-27 20:53 - 2014-04-27 20:54 - 01376768 _____ () C:\Users\Shenyu\Downloads\7-zip-64-bit.msi
2014-04-27 20:47 - 2013-08-25 21:39 - 00197120 ___SH () C:\Users\Shenyu\Downloads\Thumbs.db
2014-04-27 20:45 - 2014-04-27 20:45 - 00017510 _____ () C:\Users\Shenyu\Downloads\The.Originals.S01E19.720p.HDTV.X264-DIMENSION.de-SubCentral.rar
2014-04-24 12:32 - 2014-04-27 22:28 - 00061120 _____ (StdLib) C:\WINDOWS\system32\Drivers\{2c976a7f-dbdc-4756-870f-f6d183fe7a7e}Gw64.sys
2014-04-23 02:24 - 2013-08-22 17:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-04-23 02:24 - 2013-08-22 17:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-17 06:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-04-14 18:21 - 2014-04-14 18:21 - 00022798 _____ () C:\Users\Shenyu\Downloads\Unbenannt 1.odt
2014-04-14 18:20 - 2014-04-14 18:01 - 00022798 _____ () C:\Users\Shenyu\Documents\Unbenannt 1.odt
2014-04-14 18:08 - 2013-08-20 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2014-04-12 15:28 - 2013-08-12 11:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-09 11:11 - 2013-08-15 13:29 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-04-09 11:10 - 2013-08-12 00:35 - 90655440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-04-09 08:11 - 2014-04-09 08:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-04-09 08:11 - 2014-04-09 08:11 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-04-03 09:51 - 2014-04-30 01:38 - 00088280 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-30 01:38 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-30 01:38 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-04-01 13:09 - 2012-07-26 10:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
2014-03-31 03:16 - 2014-04-09 08:17 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-03-31 01:57 - 2014-04-09 08:17 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
Some content of TEMP:
====================
C:\Users\Shenyu\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptth3fg.dll
C:\Users\Shenyu\AppData\Local\Temp\MySearchDial.exe
C:\Users\Shenyu\AppData\Local\Temp\Quarantine.exe
C:\Users\Shenyu\AppData\Local\Temp\SHSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-30 02:12
==================== End Of Log ============================
|
| Themen zu Bin auf Spyhunter 4 und Optimizer Pro reingefallen |
| auf einmal, computer, malware, optimizer, optimizer pro, programm, programme, protector, pup.optional.browsesmart.a, pup.optional.mysearchdial.a, spyhunter, spyhunter 4, spyhunter entfernen, win32/injected.f |
Baum-Darstellung