| |
| |||||||
Log-Analyse und Auswertung: Bankdaten ausgespät, Trojaner entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
13.06.2014, 19:40
| #1 |
| |  Bankdaten ausgespät, Trojaner entfernenCode:
ATTFilter SETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=c9c44d9b498aee42a7c852c55672e5b2
# engine=18684
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-13 04:32:25
# local_time=2014-06-13 06:32:25 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 95 139891 222887 0 0
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 6031577 25614339 0 0
# scanned=271732
# found=8
# cleaned=0
# scan_time=54472
sh=5E15B25E7002AF7308300569AFEBBEC992C1172A ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Backup\C\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs_11_06_2014_16_16_20.js"
sh=A47739F27C4BC8FD3A48B4A90B40679DF1218E1B ft=1 fh=ab4f3351c96b3042 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=9AC5040984D4B0DF00FD271BE03F559A9249C423 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js"
sh=56C8CBAEB533088942E70ACFEA9B1FACD589560C ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js.BAK"
sh=A1303527D9A7BAF61130E38636FD53926A211D74 ft=1 fh=77b67014d8a47abf vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup-Downloader.exe"
sh=A7E501599B80D1E6548C85EF661C70D85A64ACD5 ft=1 fh=77b67014c21a5d01 vn="möglicherweise Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup.exe"
sh=B60CC8450EB91C56033D2ECA69506FB5B6D31122 ft=1 fh=598063cfc2fe7e7f vn="Win32/Malavida.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\desmume-windows-malavida.exe"
sh=C710AA620B81C1991468A33A5798DAF2ACED4C5E ft=1 fh=c1847d19b9c602ab vn="Variante von Win32/OpenInstall evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\FrikingShark-Downloader.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.83
Windows 7 x86 (UAC is disabled!)
Out of date service pack!!
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java(TM) 6 Update 30
Java version out of Date!
Adobe Flash Player 13.0.0.214
Adobe Reader 9
Adobe Reader XI
Mozilla Firefox 27.0.1 Firefox out of Date!
Mozilla Thunderbird (24.3.0)
Google Chrome 35.0.1916.114
Google Chrome 35.0.1916.153
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-06-2014 02
Ran by Anke (administrator) on ANKE-PC on 13-06-2014 16:30:10
Running from C:\Users\Anke\Downloads
Platform: Microsoft Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] ()
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-10] (AVAST Software)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\RunOnce: [FlashPlayerUpdate] - C:\windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [847536 2014-05-15] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.facebook.de/
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com/firefox
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-12]
FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10]
FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27]
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10]
FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02]
CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02]
CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02]
CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22]
CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-10]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2014-06-10]
========================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-10] (AVAST Software)
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
==================== Drivers (Whitelisted) ====================
R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [24184 2014-06-10] ()
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [67824 2014-06-10] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [81768 2014-06-10] (AVAST Software)
R0 aswRvrt; C:\windows\system32\Drivers\aswRvrt.sys [49944 2014-06-10] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [777488 2014-06-10] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [411680 2014-06-10] (AVAST Software)
R2 aswStm; C:\windows\system32\drivers\aswStm.sys [68312 2014-06-10] (AVAST Software)
R0 aswVmm; C:\windows\system32\Drivers\aswVmm.sys [180632 2014-06-10] ()
R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd)
R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.)
S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Anke\AppData\Local\Temp\catchme.sys [X]
S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 MpKsl80f46909; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion
2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe
2014-06-12 15:19 - 2014-06-13 16:23 - 00000000 ____D () C:\Program Files\ESET
2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe
2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt
2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt
2014-06-11 16:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-11 16:14 - 2014-06-11 16:16 - 00000000 ____D () C:\AdwCleaner
2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe
2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe
2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt
2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software
2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-10 16:36 - 2014-06-10 16:37 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe
2014-06-10 15:43 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-10 15:21 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-10 15:21 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-10 15:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-10 15:14 - 2014-06-10 15:43 - 00000000 ____D () C:\Qoobox
2014-06-10 15:14 - 2014-06-10 15:41 - 00000000 ____D () C:\windows\erdnt
2014-06-10 15:11 - 2014-06-10 15:12 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe
2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk
2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-10 15:01 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe
2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:05 - 2014-06-12 15:31 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:19 - 2014-06-10 15:02 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:10 - 2014-06-13 16:30 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-10 13:10 - 2014-06-13 16:30 - 00000000 ____D () C:\FRST
2014-06-10 13:09 - 2014-06-13 16:30 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 12:57 - 2014-06-10 15:58 - 00000000 ____D () C:\Users\Rolf
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
==================== One Month Modified Files and Folders =======
2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion
2014-06-13 16:30 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp
2014-06-13 16:30 - 2014-06-10 13:10 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-13 16:30 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST
2014-06-13 16:30 - 2014-06-10 13:09 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-13 16:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 16:23 - 2014-06-12 15:19 - 00000000 ____D () C:\Program Files\ESET
2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe
2014-06-13 16:05 - 2009-12-05 04:40 - 01598358 _____ () C:\windows\WindowsUpdate.log
2014-06-13 16:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-13 15:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
2014-06-13 12:25 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 12:18 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
2014-06-12 19:45 - 2012-10-25 21:27 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-12 15:31 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe
2014-06-12 15:13 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics
2014-06-12 15:11 - 2012-12-03 11:05 - 00018887 _____ () C:\windows\setupact.log
2014-06-12 15:11 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-12 15:11 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-12 15:07 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 15:06 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT
2014-06-12 15:01 - 2010-04-27 20:46 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt
2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt
2014-06-11 16:17 - 2012-12-16 11:56 - 04199370 _____ () C:\windows\PFRO.log
2014-06-11 16:16 - 2014-06-11 16:14 - 00000000 ____D () C:\AdwCleaner
2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe
2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe
2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt
2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-11 16:05 - 2014-01-02 17:44 - 00001848 _____ () C:\Users\Anke\Desktop\Amazon.lnk
2014-06-11 16:05 - 2014-01-02 17:44 - 00001846 _____ () C:\Users\Anke\Desktop\WEB.DE.lnk
2014-06-11 16:05 - 2010-04-24 15:56 - 00001371 _____ () C:\Users\Anke\Desktop\Internet Explorer.lnk
2014-06-11 15:49 - 2012-10-16 21:09 - 00000000 ____D () C:\ProgramData\Avira
2014-06-10 17:40 - 2009-12-05 04:46 - 00000000 ____D () C:\ProgramData\Temp
2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software
2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-10 16:41 - 2014-03-23 12:24 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:36 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe
2014-06-10 15:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf
2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:14 - 00000000 ____D () C:\Qoobox
2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-10 15:41 - 2014-06-10 15:14 - 00000000 ____D () C:\windows\erdnt
2014-06-10 15:40 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini
2014-06-10 15:38 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke
2014-06-10 15:12 - 2014-06-10 15:11 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe
2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk
2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-10 15:02 - 2014-06-10 13:19 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:09 - 2014-06-10 15:01 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
Some content of TEMP:
====================
C:\Users\Anke\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 13:56
==================== End Of Log ============================
--- --- --- --- --- --- Und wie weiss ich jetzt das mein Lappi wieder ok ist? Bin extrem auf Online-Banking angewiesen |
|
| Themen zu Bankdaten ausgespät, Trojaner entfernen |
| antivirus, association, avira, bankdaten ausgespät, browser, defender, desktop, device driver, e-banking, entfernen, flash player, js/securitydisabler.a.gen, lightning, programm, scan, services.exe, software, svchost.exe, trojaner, updates, win32/downloadsponsor.a, win32/malavida.a, win32/toolbar.conduit.y, windows xp |
Hybrid-Darstellung
