| |
| |||||||
Log-Analyse und Auswertung: Bankdaten ausgespät, Trojaner entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
10.06.2014, 14:44
| #1 |
| |  Bankdaten ausgespät, Trojaner entfernen FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03 Ran by Anke (administrator) on ANKE-PC on 10-06-2014 14:59:00 Running from C:\Users\Anke\Downloads Platform: Microsoft Windows 7 Home Premium (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe () C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe (SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Teruten) C:\Windows\System32\FsUsbExService.Exe (SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe () C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe () C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung) C:\Program Files\Samsung\Kies\Kies.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] () HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.) HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor) HKLM\...\Run: [Ocs_SM] => C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-08-10] (OCS) HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated) HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [] => [X] HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation) HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [Facebook Update] => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-12-05] (Google Inc.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e2fa-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e33a-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e37d-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {6d985358-73cd-11e3-a05a-002454e4b71c} - F:\SETUP.EXE HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e64919-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e6494c-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://www.facebook.com/ URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms} SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6963712E636F6D2F7365617263682F726573756C74732E7068703F713D7B7365617263685465726D737D2663685F69643D6F7364&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com.anonymize-me.de/?anonymto=687474703A2F2F6474732E7365617263682D726573756C74732E636F6D2F73723F7372633D6965622661707069643D3130312673797374656D69643D3430362673723D3026713D7B7365617263685465726D737D&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO: Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können. - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) BHO: ICQ Sparberater - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - No File BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - No File Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default FF DefaultSearchEngine: Google FF SearchEngineOrder.1: Ask.com FF SelectedSearchEngine: Google FF Homepage: hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/ FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) FF user.js: detected! => C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\user.js FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\toolbar@ask.com [2012-10-16] FF Extension: toolplugin - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com [2011-11-02] FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-03-23] FF Extension: ICQ Toolbar - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012-07-28] FF Extension: ICQ Sparberater - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\ciuvo-extension@icq.de.xpi [2011-10-05] FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10] FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27] FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13] FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR StartupUrls: "hxxp://www.google.com/" CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02] CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02] CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02] CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22] CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02] CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2011-07-13] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-22] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation) R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed] R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation) R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] () R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed] R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.) S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] () R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] () R2 SearchAnonymizer; C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-08-10] () [File not signed] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-01-07] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [69240 2014-01-07] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd) R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed] R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-10] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation) S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.) R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2014-01-07] (Avira GmbH) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] () S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X] S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S1 MpKslabc952c6; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKslabc952c6.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:05 - 2014-06-10 14:53 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:10 - 2014-06-10 14:59 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-10 13:10 - 2014-06-10 14:59 - 00000000 ____D () C:\FRST 2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo! 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe 2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-10 12:58 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google 2014-06-10 12:57 - 2014-06-10 13:04 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp 2014-06-10 12:57 - 2014-06-10 13:02 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk 2014-06-10 12:57 - 2014-06-10 13:02 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk 2014-06-10 12:57 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 12:57 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore 2014-06-10 12:57 - 2010-11-10 23:25 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Microsoft Help 2014-06-10 12:57 - 2010-04-24 15:55 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam 2014-06-10 12:57 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-06-10 12:57 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER ==================== One Month Modified Files and Folders ======= 2014-06-10 14:59 - 2014-06-10 13:10 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-10 14:59 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST 2014-06-10 14:59 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Local\Temp 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:53 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-10 14:52 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics 2014-06-10 14:52 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 14:50 - 2012-12-03 11:05 - 00018495 _____ () C:\windows\setupact.log 2014-06-10 14:50 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-10 14:50 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-10 14:49 - 2012-12-16 11:56 - 04194830 _____ () C:\windows\PFRO.log 2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME 2014-06-10 14:48 - 2009-12-05 04:40 - 01352990 _____ () C:\windows\WindowsUpdate.log 2014-06-10 14:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 14:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:23 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 13:04 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp 2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo! 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe 2014-06-10 13:02 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google 2014-06-10 13:02 - 2014-06-10 12:57 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk 2014-06-10 13:02 - 2014-06-10 12:57 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk 2014-06-10 13:02 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-10 12:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf 2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore 2014-06-10 12:23 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job 2014-06-10 12:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job 2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-16 11:10 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-05-16 11:08 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT 2014-05-16 11:02 - 2010-04-27 20:46 - 90547776 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe 2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl 2014-05-12 07:26 - 2014-06-10 14:05 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-06-10 14:05 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:25 - 2014-06-10 14:05 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys Some content of TEMP: ==================== C:\Users\Anke\AppData\Local\Temp\avgnt.exe C:\Users\Anke\AppData\Local\Temp\COMPUTERBILD Vorteil-Center-Installation.exe C:\Users\Anke\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Anke\AppData\Local\Temp\ose00000.exe C:\Users\Anke\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Anke\AppData\Local\Temp\_is6E7B.exe ==================== Bamital & volsnap Check ================= C:\windows\explorer.exe => File is digitally signed C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-08 13:56 ==================== End Of Log ============================ --- --- --- --- --- --- Hy Combofix, läuft nicht bis zum Ende durch, da ich weder Antivir noch Windows Security Essentials, sowohl als Antivir als auch als Antispy nicht beenden kann, da auch hier die Meldung erscheint, Zugriff verweigert... Code:
ATTFilter omboFix 14-06-10.01 - Anke 10.06.2014 15:24:08.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3033.1868 [GMT 2:00]
ausgeführt von:: c:\users\Anke\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Avira Desktop *Enabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1CD0CB2B-84B4-452D-8919-DC503DF260AE}.xps
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B963BFB0-1472-45CF-A74B-539404A932F2}.xps
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EBE21F1F-1356-43F5-B73D-C893A24EBEA0}.xps
c:\users\Anke\AppData\Roaming\.#
c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572760.###
c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572790.###
c:\users\Anke\AppData\Roaming\Kysea
c:\users\Anke\AppData\Roaming\Kysea\liyhe.eqo
c:\users\Anke\ia_remove.sh4401.tmp
c:\users\Anke\ia_remove.sh6433.tmp
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-05-10 bis 2014-06-10 ))))))))))))))))))))))))))))))
.
.
2014-06-10 13:39 . 2014-06-10 13:40 -------- d-----w- c:\users\Anke\AppData\Local\temp
2014-06-10 13:39 . 2014-06-10 13:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-10 13:14 . 2014-06-10 13:14 39464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys
2014-06-10 13:02 . 2014-06-10 13:02 -------- d-----w- c:\program files\VS Revo Group
2014-06-10 12:05 . 2014-06-10 12:53 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware
2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\programdata\Malwarebytes
2014-06-10 12:05 . 2014-05-12 05:26 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-06-10 12:05 . 2014-05-12 05:25 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-06-10 12:05 . 2014-05-12 05:25 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\users\Anke\AppData\Local\Programs
2014-06-10 11:10 . 2014-06-10 13:02 -------- d-----w- C:\FRST
2014-06-10 11:07 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\mpengine.dll
2014-06-10 10:57 . 2014-06-10 10:58 -------- d-----w- c:\users\Rolf
2014-06-09 10:44 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-06-05 11:40 . 2014-05-02 11:27 765968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C13CC024-D0E5-4524-915C-1EE8839D22E6}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-15 10:01 . 2012-05-03 11:10 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-15 10:01 . 2011-07-24 19:59 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-02 11:27 . 2014-03-14 14:59 765968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-04-29 08:37 . 2014-01-07 10:10 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-04-29 08:37 . 2014-01-07 10:10 93528 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-04-15 00:34 . 2014-04-15 00:34 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-06-11 14:24 . 2010-06-11 14:24 6 ----a-w- c:\program files\Common Files\UnInstallCompleted.tmp
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-05 39408]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2013-07-26 844656]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-07-26 1564016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"fsn"="c:\program files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe" [2010-04-26 137792]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-22 175640]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-22 141848]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-14 8120864]
"Ocs_SM"="c:\users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2012-08-10 106496]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-07-26 311152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-05-22 737872]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe -s [2013-12-7 11474272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Facebook Update"="c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
"KiesPDLR"=c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
"AutoStartNPSAgent"=c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe"
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe"
"Persistence"=c:\windows\system32\igfxpers.exe
"KiesTrayAgent"=c:\program files\Samsung\Kies\KiesTrayAgent.exe
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
R2 MBAMScheduler;MBAMScheduler;c:\program files\ Malwarebytes Anti-Malware \mbamscheduler.exe [2014-05-12 1809720]
R2 MBAMService;MBAMService;c:\program files\ Malwarebytes Anti-Malware \mbamservice.exe [2014-05-12 860472]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-12-08 30312]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-05-12 23256]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-05-12 51928]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-01-07 37352]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-01-02 243128]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-05-22 430160]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2014-05-22 1039952]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2014-01-07 69240]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-29 238952]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-01-08 126976]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - MPKSL80F46909
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-22 08:27 1091912 ----a-w- c:\program files\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 10:01]
.
2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
- c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13]
.
2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
- c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13]
.
2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55]
.
2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = <local>
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\05C6169637965627: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\75C414E4D2832353239383: DhcpNameServer = 192.168.2.1 192.168.2.1
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} - hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
FF - ProfilePath - c:\users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{FE163F11-1919-4257-A280-FF5AF8DAEECB} - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-{43B74FAB-FB58-447D-8D3A-5F638AF36FD1} - c:\programdata\{87B61FE8-334F-4066-B7AA-68DC81782D4D}\Netzmanager1.071.0301_120720a.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-958610902.www.dreamload.com - c:\program files\Microsoft Silverlight\5.1.20913.0\Silverlight.Configuration.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-10 15:42:58
ComboFix-quarantined-files.txt 2014-06-10 13:42
.
Vor Suchlauf: 10 Verzeichnis(se), 73.167.224.832 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 76.034.895.872 Bytes frei
.
- - End Of File - - 0063E1D5C36869DF2EA37C9EB60BADC7
2E5DEBB2116B3417023E0D6562D7ED07
Geändert von jemgumeranke (10.06.2014 um 14:18 Uhr) Grund: Edit |
|
| Themen zu Bankdaten ausgespät, Trojaner entfernen |
| antivirus, association, avira, bankdaten ausgespät, browser, defender, desktop, device driver, e-banking, entfernen, flash player, js/securitydisabler.a.gen, lightning, programm, scan, services.exe, software, svchost.exe, trojaner, updates, win32/downloadsponsor.a, win32/malavida.a, win32/toolbar.conduit.y, windows xp |
Hybrid-Darstellung
