|
Log-Analyse und Auswertung: Bankdaten ausgespät, Trojaner entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.06.2014, 13:02 | #1 | |||
| Bankdaten ausgespät, Trojaner entfernen Hallo, am Samstag wurde mir durch meine Bank mitgeteilt, das ich einen Trojaner auf meinem Laptop haben soll und daraufhin mein Online-Banking gesperrt. Ich solle den Trojaner entfernen bzw. entfernen lassen. Leider habe ich keinen Zugriff mehr auf Antivir. Meldung: Dieses Programm wurde durch eine Gruppenrichtlinie blockiert. Weitere Infos erhalten Sie vom Systemadmin. (Bin selbst als Admin eingetragen.) Deinstallieren ist nicht möglich, dort kommt folgende Meldung: Sie verfügen nicht über ausreichnende Berechtigungen, Um Avira zu deinstallieren. Wenden Sie sich an den Systemadministrator. Habe Defogger, FRST und GMER durchgeführt und hänge diese jetzt an. Defogger hat keine Log erstellt: Zitat:
Zitat:
Zitat:
|
10.06.2014, 13:36 | #2 |
/// the machine /// TB-Ausbilder | Bankdaten ausgespät, Trojaner entfernen hi,
__________________So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Adware & Co. deinstallieren
Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Scan mit Combofix
__________________ |
10.06.2014, 14:44 | #3 |
| Bankdaten ausgespät, Trojaner entfernen FRST Logfile:
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03 Ran by Anke (administrator) on ANKE-PC on 10-06-2014 14:59:00 Running from C:\Users\Anke\Downloads Platform: Microsoft Windows 7 Home Premium (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe () C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe (SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Teruten) C:\Windows\System32\FsUsbExService.Exe (SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe () C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe () C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung) C:\Program Files\Samsung\Kies\Kies.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] () HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.) HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor) HKLM\...\Run: [Ocs_SM] => C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-08-10] (OCS) HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated) HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [] => [X] HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation) HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [Facebook Update] => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-12-05] (Google Inc.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e2fa-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e33a-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e37d-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {6d985358-73cd-11e3-a05a-002454e4b71c} - F:\SETUP.EXE HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e64919-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e6494c-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://www.facebook.com/ URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms} SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6963712E636F6D2F7365617263682F726573756C74732E7068703F713D7B7365617263685465726D737D2663685F69643D6F7364&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com.anonymize-me.de/?anonymto=687474703A2F2F6474732E7365617263682D726573756C74732E636F6D2F73723F7372633D6965622661707069643D3130312673797374656D69643D3430362673723D3026713D7B7365617263685465726D737D&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO: Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können. - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) BHO: ICQ Sparberater - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - No File BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - No File Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default FF DefaultSearchEngine: Google FF SearchEngineOrder.1: Ask.com FF SelectedSearchEngine: Google FF Homepage: hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/ FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) FF user.js: detected! => C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\user.js FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\toolbar@ask.com [2012-10-16] FF Extension: toolplugin - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com [2011-11-02] FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-03-23] FF Extension: ICQ Toolbar - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012-07-28] FF Extension: ICQ Sparberater - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\ciuvo-extension@icq.de.xpi [2011-10-05] FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10] FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27] FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13] FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR StartupUrls: "hxxp://www.google.com/" CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02] CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02] CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02] CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22] CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02] CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2011-07-13] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-22] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation) R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed] R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation) R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] () R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed] R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.) S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] () R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] () R2 SearchAnonymizer; C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-08-10] () [File not signed] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-01-07] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [69240 2014-01-07] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd) R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed] R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-10] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation) S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.) R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2014-01-07] (Avira GmbH) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] () S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X] S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S1 MpKslabc952c6; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKslabc952c6.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:05 - 2014-06-10 14:53 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:10 - 2014-06-10 14:59 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-10 13:10 - 2014-06-10 14:59 - 00000000 ____D () C:\FRST 2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo! 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe 2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-10 12:58 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google 2014-06-10 12:57 - 2014-06-10 13:04 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp 2014-06-10 12:57 - 2014-06-10 13:02 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk 2014-06-10 12:57 - 2014-06-10 13:02 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk 2014-06-10 12:57 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 12:57 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore 2014-06-10 12:57 - 2010-11-10 23:25 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Microsoft Help 2014-06-10 12:57 - 2010-04-24 15:55 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam 2014-06-10 12:57 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-06-10 12:57 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER ==================== One Month Modified Files and Folders ======= 2014-06-10 14:59 - 2014-06-10 13:10 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-10 14:59 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST 2014-06-10 14:59 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Local\Temp 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:53 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-10 14:52 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics 2014-06-10 14:52 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 14:50 - 2012-12-03 11:05 - 00018495 _____ () C:\windows\setupact.log 2014-06-10 14:50 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-10 14:50 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-10 14:49 - 2012-12-16 11:56 - 04194830 _____ () C:\windows\PFRO.log 2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME 2014-06-10 14:48 - 2009-12-05 04:40 - 01352990 _____ () C:\windows\WindowsUpdate.log 2014-06-10 14:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 14:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:23 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 13:04 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp 2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo! 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google 2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe 2014-06-10 13:02 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google 2014-06-10 13:02 - 2014-06-10 12:57 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk 2014-06-10 13:02 - 2014-06-10 12:57 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk 2014-06-10 13:02 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-10 12:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf 2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf 2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore 2014-06-10 12:23 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job 2014-06-10 12:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job 2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-16 11:10 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-05-16 11:08 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT 2014-05-16 11:02 - 2010-04-27 20:46 - 90547776 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe 2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl 2014-05-12 07:26 - 2014-06-10 14:05 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-06-10 14:05 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:25 - 2014-06-10 14:05 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys Some content of TEMP: ==================== C:\Users\Anke\AppData\Local\Temp\avgnt.exe C:\Users\Anke\AppData\Local\Temp\COMPUTERBILD Vorteil-Center-Installation.exe C:\Users\Anke\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Anke\AppData\Local\Temp\ose00000.exe C:\Users\Anke\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Anke\AppData\Local\Temp\_is6E7B.exe ==================== Bamital & volsnap Check ================= C:\windows\explorer.exe => File is digitally signed C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-08 13:56 ==================== End Of Log ============================ --- --- --- --- --- --- Hy Combofix, läuft nicht bis zum Ende durch, da ich weder Antivir noch Windows Security Essentials, sowohl als Antivir als auch als Antispy nicht beenden kann, da auch hier die Meldung erscheint, Zugriff verweigert... Code:
ATTFilter omboFix 14-06-10.01 - Anke 10.06.2014 15:24:08.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3033.1868 [GMT 2:00] ausgeführt von:: c:\users\Anke\Desktop\ComboFix.exe AV: Avira Desktop *Enabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859} AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F} SP: Avira Desktop *Enabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4} SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1CD0CB2B-84B4-452D-8919-DC503DF260AE}.xps c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B963BFB0-1472-45CF-A74B-539404A932F2}.xps c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EBE21F1F-1356-43F5-B73D-C893A24EBEA0}.xps c:\users\Anke\AppData\Roaming\.# c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572760.### c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572790.### c:\users\Anke\AppData\Roaming\Kysea c:\users\Anke\AppData\Roaming\Kysea\liyhe.eqo c:\users\Anke\ia_remove.sh4401.tmp c:\users\Anke\ia_remove.sh6433.tmp c:\windows\system32\System32\MASetupCleaner.exe c:\windows\system32\System32\muzapp.exe . . ((((((((((((((((((((((( Dateien erstellt von 2014-05-10 bis 2014-06-10 )))))))))))))))))))))))))))))) . . 2014-06-10 13:39 . 2014-06-10 13:40 -------- d-----w- c:\users\Anke\AppData\Local\temp 2014-06-10 13:39 . 2014-06-10 13:39 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-06-10 13:14 . 2014-06-10 13:14 39464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys 2014-06-10 13:02 . 2014-06-10 13:02 -------- d-----w- c:\program files\VS Revo Group 2014-06-10 12:05 . 2014-06-10 12:53 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware 2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\programdata\Malwarebytes 2014-06-10 12:05 . 2014-05-12 05:26 51928 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-06-10 12:05 . 2014-05-12 05:25 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-06-10 12:05 . 2014-05-12 05:25 23256 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-06-10 12:05 . 2014-06-10 12:05 -------- d-----w- c:\users\Anke\AppData\Local\Programs 2014-06-10 11:10 . 2014-06-10 13:02 -------- d-----w- C:\FRST 2014-06-10 11:07 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\mpengine.dll 2014-06-10 10:57 . 2014-06-10 10:58 -------- d-----w- c:\users\Rolf 2014-06-09 10:44 . 2014-04-30 23:37 8073384 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2014-06-05 11:40 . 2014-05-02 11:27 765968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C13CC024-D0E5-4524-915C-1EE8839D22E6}\gapaengine.dll . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-05-15 10:01 . 2012-05-03 11:10 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-05-15 10:01 . 2011-07-24 19:59 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-05-02 11:27 . 2014-03-14 14:59 765968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2014-04-29 08:37 . 2014-01-07 10:10 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys 2014-04-29 08:37 . 2014-01-07 10:10 93528 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2014-04-15 00:34 . 2014-04-15 00:34 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX 2010-06-11 14:24 . 2010-06-11 14:24 6 ----a-w- c:\program files\Common Files\UnInstallCompleted.tmp . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800] . [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432] "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-05 39408] "KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2013-07-26 844656] "KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-07-26 1564016] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "fsn"="c:\program files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe" [2010-04-26 137792] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-22 175640] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-22 141848] "UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504] "UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504] "UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408] "UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504] "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472] "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-14 8120864] "Ocs_SM"="c:\users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2012-08-10 106496] "UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448] "Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072] "KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-07-26 311152] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-05-22 737872] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe -s [2013-12-7 11474272] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Facebook Update"="c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver "KiesPDLR"=c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe "AutoStartNPSAgent"=c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "APLangApp"="c:\program files\AnyPC Client\APLangApp.exe" "CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" "Persistence"=c:\windows\system32\igfxpers.exe "KiesTrayAgent"=c:\program files\Samsung\Kies\KiesTrayAgent.exe "HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe . R2 MBAMScheduler;MBAMScheduler;c:\program files\ Malwarebytes Anti-Malware \mbamscheduler.exe [2014-05-12 1809720] R2 MBAMService;MBAMService;c:\program files\ Malwarebytes Anti-Malware \mbamservice.exe [2014-05-12 860472] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-12-08 30312] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x] R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x] R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x] R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x] R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x] R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x] R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-05-12 23256] R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-05-12 51928] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-01-07 37352] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-01-02 243128] S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-05-22 430160] S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2014-05-22 1039952] S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2014-01-07 69240] S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-29 238952] S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-01-08 126976] . . --- Andere Dienste/Treiber im Speicher --- . *NewlyCreated* - FSUSBEXDISK *NewlyCreated* - MPKSL80F46909 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr HPService REG_MULTI_SZ HPSLPSVC hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-05-22 08:27 1091912 ----a-w- c:\program files\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2014-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 10:01] . 2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job - c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13] . 2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job - c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13] . 2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55] . 2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.de/ uInternet Settings,ProxyOverride = <local> IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105 IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000 IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} TCP: DhcpNameServer = 192.168.178.1 TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}: DhcpNameServer = 192.168.178.1 TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\05C6169637965627: DhcpNameServer = 192.168.178.1 TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\75C414E4D2832353239383: DhcpNameServer = 192.168.2.1 192.168.2.1 DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} - hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab FF - ProfilePath - c:\users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/ FF - prefs.js: network.proxy.type - 0 FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . - - - - Entfernte verwaiste Registrierungseinträge - - - - . BHO-{FE163F11-1919-4257-A280-FF5AF8DAEECB} - (no file) Toolbar-Locked - (no file) Toolbar-10 - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS AddRemove-{43B74FAB-FB58-447D-8D3A-5F638AF36FD1} - c:\programdata\{87B61FE8-334F-4066-B7AA-68DC81782D4D}\Netzmanager1.071.0301_120720a.exe AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe AddRemove-958610902.www.dreamload.com - c:\program files\Microsoft Silverlight\5.1.20913.0\Silverlight.Configuration.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2014-06-10 15:42:58 ComboFix-quarantined-files.txt 2014-06-10 13:42 . Vor Suchlauf: 10 Verzeichnis(se), 73.167.224.832 Bytes frei Nach Suchlauf: 16 Verzeichnis(se), 76.034.895.872 Bytes frei . - - End Of File - - 0063E1D5C36869DF2EA37C9EB60BADC7 2E5DEBB2116B3417023E0D6562D7ED07 Geändert von jemgumeranke (10.06.2014 um 14:18 Uhr) Grund: Edit |
11.06.2014, 08:26 | #4 |
/// the machine /// TB-Ausbilder | Bankdaten ausgespät, Trojaner entfernen Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
11.06.2014, 15:36 | #5 |
| Bankdaten ausgespät, Trojaner entfernen Ja, habe die 3 Programme durchgeführt. Hier die Logs: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malware Protection, Starting, Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malware Protection, Started, Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting, Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malware Protection, Starting, Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malware Protection, Started, Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting, Protection, 11.06.2014 16:03:01, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Started, Update, 11.06.2014 16:05:25, SYSTEM, ANKE-PC, Scheduler, Malware Database, 2014.6.10.6, 2014.6.11.4, Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Refresh, Starting, Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Stopping, Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Stopped, Protection, 11.06.2014 16:05:34, SYSTEM, ANKE-PC, Protection, Refresh, Success, Protection, 11.06.2014 16:05:34, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting, Protection, 11.06.2014 16:05:35, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Started, (end) Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 11/06/2014 um 16:16:12 # Aktualisiert 05/06/2014 von Xplode # Betriebssystem : Windows 7 Home Premium (32 bits) # Benutzername : Anke - ANKE-PC # Gestartet von : C:\Users\Anke\Desktop\adwcleaner_3.212.exe # Option : Löschen ***** [ Dienste ] ***** Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Partner Ordner Gelöscht : C:\Program Files\Ask.com Ordner Gelöscht : C:\Program Files\Conduit Ordner Gelöscht : C:\Program Files\Mein Gutscheincode Finder Ordner Gelöscht : C:\windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe} Ordner Gelöscht : C:\Users\Anke\AppData\Local\AskToolbar Ordner Gelöscht : C:\Users\Anke\AppData\Local\Ilivid Player Ordner Gelöscht : C:\Users\Anke\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\AskToolbar Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\DataMngr Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\searchquband Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\DesktopIconForAmazon Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Toolplugin Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\ICQToolbarData Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com Datei Gelöscht : C:\Users\Anke\Desktop\eBay.lnk Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Askcom.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Ocs_SM] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nasa-world-wind[1]_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nasa-world-wind[1]_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}] Schlüssel Gelöscht : HKCU\Software\APN Schlüssel Gelöscht : HKCU\Software\Ask.com Schlüssel Gelöscht : HKCU\Software\Ciuvo Schlüssel Gelöscht : HKCU\Software\Myfree Codec Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\Softonic Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar Schlüssel Gelöscht : HKLM\Software\APN Schlüssel Gelöscht : HKLM\Software\Myfree Codec Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4 ***** [ Browser ] ***** -\\ Internet Explorer v9.0.8112.16476 Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search] -\\ Mozilla Firefox v27.0.1 (de) [ Datei : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js ] Zeile gelöscht : user_pref("extensions.asktb.InstallDir", "C:\\Program Files\\Ask.com\\"); Zeile gelöscht : user_pref("extensions.asktb.OOBEVersion", "1"); Zeile gelöscht : user_pref("extensions.asktb.apn_dbr", "ie_9.0.8112.16421"); Zeile gelöscht : user_pref("extensions.asktb.autofill-text-highlight-enabled", true); Zeile gelöscht : user_pref("extensions.asktb.cbid", "^AGS"); Zeile gelöscht : user_pref("extensions.asktb.config-updated", true); Zeile gelöscht : user_pref("extensions.asktb.crumb", "2012.10.16+12.08.32-toolbar014iad-DE-S2Fzc2VsLEdlcm1hbnk%3D"); Zeile gelöscht : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://avira-int.ask.com/web?q={query}&qsrc={qsrc}&o={o}&l={l}&gct=bar&locale={locale}"); Zeile gelöscht : user_pref("extensions.asktb.domain", "avira-int.ask.com"); Zeile gelöscht : user_pref("extensions.asktb.domainName", "avira-int.ask.com"); Zeile gelöscht : user_pref("extensions.asktb.dtid", "^YYYYYY^YY^DE"); Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q="); Zeile gelöscht : user_pref("extensions.asktb.fresh-install", false); Zeile gelöscht : user_pref("extensions.asktb.guid", "7c03ab2d-32f2-475c-8015-036e72b51cea"); Zeile gelöscht : user_pref("extensions.asktb.hpr", "YES"); Zeile gelöscht : user_pref("extensions.asktb.if", "su"); Zeile gelöscht : user_pref("extensions.asktb.keyword-toggled-in-session", false); Zeile gelöscht : user_pref("extensions.asktb.last-config-req", "1402413961012"); Zeile gelöscht : user_pref("extensions.asktb.last-search-timestamp", "1358092774601"); Zeile gelöscht : user_pref("extensions.asktb.last-v", "3.15.26.100015"); Zeile gelöscht : user_pref("extensions.asktb.locale", "de_DE"); Zeile gelöscht : user_pref("extensions.asktb.localePref", true); Zeile gelöscht : user_pref("extensions.asktb.location", "Kassel,Germany"); Zeile gelöscht : user_pref("extensions.asktb.nthp", "YES"); Zeile gelöscht : user_pref("extensions.asktb.nthp_prev", "1"); Zeile gelöscht : user_pref("extensions.asktb.o", "APN10261"); Zeile gelöscht : user_pref("extensions.asktb.overlay-reloaded-using-restart", true); Zeile gelöscht : user_pref("extensions.asktb.qsrc", "2871"); Zeile gelöscht : user_pref("extensions.asktb.r", "5"); Zeile gelöscht : user_pref("extensions.asktb.sa", "YES"); Zeile gelöscht : user_pref("extensions.asktb.saguid", "887AEBCC-AC07-4601-A9B7-0331970CA726"); Zeile gelöscht : user_pref("extensions.asktb.search-history-queries", "was ist Weinstein||cala ratjada neuigkeiten||ebay||unwetterzentrale deutschland||youtube mallorca||lionie ritchi||lionel Richi schönheitsoperation[...] Zeile gelöscht : user_pref("extensions.asktb.search-suggestions-enabled", true); Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade", true); Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", true); Zeile gelöscht : user_pref("extensions.asktb.socialmini-first", true); Zeile gelöscht : user_pref("extensions.asktb.socialmini-interval", "1200000"); Zeile gelöscht : user_pref("extensions.asktb.socialmini-max-char-ticker", "33"); Zeile gelöscht : user_pref("extensions.asktb.socialmini-max-items", "30"); Zeile gelöscht : user_pref("extensions.asktb.socialmini-native-on", true); Zeile gelöscht : user_pref("extensions.asktb.socialmini-speed", "5000"); Zeile gelöscht : user_pref("extensions.asktb.themeid", ""); Zeile gelöscht : user_pref("extensions.asktb.timeinstalled", "20.10.2012 21:45:19"); Zeile gelöscht : user_pref("extensions.asktb.to", ""); Zeile gelöscht : user_pref("extensions.asktb.v", "3.15.26.100015"); Zeile gelöscht : user_pref("extensions.asktb.version", "5.15.26.45268"); Zeile gelöscht : user_pref("extensions.enabledAddons", "google%40hitachi.com:0.3,welcome%40toolmin.com:1.03,%7B800b5000-a755-47e1-992b-48a1c1357f07%7D:1.5.3,finder%40meingutscheincode.de:3.0.2,wrc%40avast.com:9.0.2018[...] Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false); Zeile gelöscht : user_pref("icqtoolbar.defSearchChange", true); Zeile gelöscht : user_pref("icqtoolbar.engineVerified", true); Zeile gelöscht : user_pref("icqtoolbar.facebookSmilesAddonShowedPopup", true); Zeile gelöscht : user_pref("icqtoolbar.firstTbRun", false); Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1402413960); Zeile gelöscht : user_pref("icqtoolbar.history", "ewe%20w%C3%A4rme%20plus%23||Kosten%20f%C3%BCr%20Anbau||Was%20kostest%20ein%20schl%C3%BCsselfertiger%20Anbau%20von%20ca.%2050%20m%C2%B2||welches%20flugzeug%20fliegt%20g[...] Zeile gelöscht : user_pref("icqtoolbar.hpChange", true); Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49); Zeile gelöscht : user_pref("icqtoolbar.installTime", "1343503399"); Zeile gelöscht : user_pref("icqtoolbar.installsource", "1"); Zeile gelöscht : user_pref("icqtoolbar.newtab_most_visited_state", "1"); Zeile gelöscht : user_pref("icqtoolbar.newtab_recently_closed_state", "1"); Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1"); Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0); Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "27.0.1"); Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no"); Zeile gelöscht : user_pref("icqtoolbar.suggestions", false); Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "131772683613177267161317830510638"); Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1402413972); Zeile gelöscht : user_pref("icqtoolbar.userEngineApproved", true); Zeile gelöscht : user_pref("icqtoolbar.userHpApproved", true); Zeile gelöscht : user_pref("icqtoolbar.version", "1.5.3"); Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0); Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0); Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0); Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0); Zeile gelöscht : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", false); Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false); Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de"); -\\ Google Chrome v35.0.1916.114 [ Datei : C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms} ************************* AdwCleaner[R0].txt - [18862 octets] - [11/06/2014 16:14:35] AdwCleaner[S0].txt - [18726 octets] - [11/06/2014 16:16:12] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18787 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.3 (03.23.2014:1) OS: Windows 7 Home Premium x86 Ran by Anke on 11.06.2014 at 16:23:36,85 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iLividSetupV1[1]_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iLividSetupV1[1]_RASMANCS Successfully deleted: [Registry Key] "hkey_current_user\software\classes\typelib\{006ad7b2-968a-11de-88c9-5bde55d89593}" Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}" ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess" Successfully deleted: [Folder] "C:\Program Files\myfree codec" ~~~ FireFox Emptied folder: C:\Users\Anke\AppData\Roaming\mozilla\firefox\profiles\etpvy6y5.default\minidumps [119 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 11.06.2014 at 16:31:43,81 Computer was rebooted End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
12.06.2014, 08:00 | #6 |
/// the machine /// TB-Ausbilder | Bankdaten ausgespät, Trojaner entfernenESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Bankdaten ausgespät, Trojaner entfernen |
13.06.2014, 19:40 | #7 |
| Bankdaten ausgespät, Trojaner entfernenCode:
ATTFilter SETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7587 # api_version=3.0.2 # EOSSerial=c9c44d9b498aee42a7c852c55672e5b2 # engine=18684 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-06-13 04:32:25 # local_time=2014-06-13 06:32:25 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7600 NT # compatibility_mode_1='avast! Antivirus' # compatibility_mode=783 16777213 100 95 139891 222887 0 0 # compatibility_mode_1='Microsoft Security Essentials' # compatibility_mode=5895 16777213 100 100 6031577 25614339 0 0 # scanned=271732 # found=8 # cleaned=0 # scan_time=54472 sh=5E15B25E7002AF7308300569AFEBBEC992C1172A ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Backup\C\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs_11_06_2014_16_16_20.js" sh=A47739F27C4BC8FD3A48B4A90B40679DF1218E1B ft=1 fh=ab4f3351c96b3042 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir" sh=9AC5040984D4B0DF00FD271BE03F559A9249C423 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js" sh=56C8CBAEB533088942E70ACFEA9B1FACD589560C ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js.BAK" sh=A1303527D9A7BAF61130E38636FD53926A211D74 ft=1 fh=77b67014d8a47abf vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup-Downloader.exe" sh=A7E501599B80D1E6548C85EF661C70D85A64ACD5 ft=1 fh=77b67014c21a5d01 vn="möglicherweise Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup.exe" sh=B60CC8450EB91C56033D2ECA69506FB5B6D31122 ft=1 fh=598063cfc2fe7e7f vn="Win32/Malavida.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\desmume-windows-malavida.exe" sh=C710AA620B81C1991468A33A5798DAF2ACED4C5E ft=1 fh=c1847d19b9c602ab vn="Variante von Win32/OpenInstall evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\FrikingShark-Downloader.exe" Code:
ATTFilter Results of screen317's Security Check version 0.99.83 Windows 7 x86 (UAC is disabled!) Out of date service pack!! Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Microsoft Security Essentials avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` CCleaner Java(TM) 6 Update 30 Java version out of Date! Adobe Flash Player 13.0.0.214 Adobe Reader 9 Adobe Reader XI Mozilla Firefox 27.0.1 Firefox out of Date! Mozilla Thunderbird (24.3.0) Google Chrome 35.0.1916.114 Google Chrome 35.0.1916.153 ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe AVAST Software Avast AvastSvc.exe AVAST Software Avast avastui.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-06-2014 02 Ran by Anke (administrator) on ANKE-PC on 13-06-2014 16:30:10 Running from C:\Users\Anke\Downloads Platform: Microsoft Windows 7 Home Premium (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Teruten) C:\Windows\System32\FsUsbExService.Exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe (SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe () C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe (Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] () HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.) HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor) HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated) HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-10] (AVAST Software) HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung) HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\RunOnce: [FlashPlayerUpdate] - C:\windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [847536 2014-05-15] (Adobe Systems Incorporated) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.facebook.de/ URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376 SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0 SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0 BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default FF SearchEngineOrder.1: Google FF SelectedSearchEngine: Google FF Homepage: hxxp://www.google.com/firefox FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q= FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-12] FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10] FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27] FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10] FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10] FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR StartupUrls: "hxxp://www.google.com/" CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media ) CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc) CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc) CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02] CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02] CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02] CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22] CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-10] CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2014-06-10] ========================== Services (Whitelisted) ================= R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-10] (AVAST Software) S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation) S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed] S2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed] R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation) R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] () S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed] R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.) S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] () R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] () ==================== Drivers (Whitelisted) ==================== R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [24184 2014-06-10] () R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [67824 2014-06-10] (AVAST Software) R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [81768 2014-06-10] (AVAST Software) R0 aswRvrt; C:\windows\system32\Drivers\aswRvrt.sys [49944 2014-06-10] () R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [777488 2014-06-10] (AVAST Software) R1 aswSP; C:\windows\system32\drivers\aswSP.sys [411680 2014-06-10] (AVAST Software) R2 aswStm; C:\windows\system32\drivers\aswStm.sys [68312 2014-06-10] (AVAST Software) R0 aswVmm; C:\windows\system32\Drivers\aswVmm.sys [180632 2014-06-10] () R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd) R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed] S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation) S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.) S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] () U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\Users\Anke\AppData\Local\Temp\catchme.sys [X] S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X] S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S1 MpKsl80f46909; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion 2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe 2014-06-12 15:19 - 2014-06-13 16:23 - 00000000 ____D () C:\Program Files\ESET 2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe 2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt 2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT 2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt 2014-06-11 16:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll 2014-06-11 16:14 - 2014-06-11 16:16 - 00000000 ____D () C:\AdwCleaner 2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe 2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe 2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt 2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software 2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300 2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300 2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe 2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr 2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys 2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software 2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-06-10 16:36 - 2014-06-10 16:37 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe 2014-06-10 15:43 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp 2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt 2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-10 15:21 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe 2014-06-10 15:21 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe 2014-06-10 15:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe 2014-06-10 15:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe 2014-06-10 15:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe 2014-06-10 15:21 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe 2014-06-10 15:21 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe 2014-06-10 15:21 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe 2014-06-10 15:14 - 2014-06-10 15:43 - 00000000 ____D () C:\Qoobox 2014-06-10 15:14 - 2014-06-10 15:41 - 00000000 ____D () C:\windows\erdnt 2014-06-10 15:11 - 2014-06-10 15:12 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe 2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk 2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-06-10 15:01 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:05 - 2014-06-12 15:31 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:19 - 2014-06-10 15:02 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:10 - 2014-06-13 16:30 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-10 13:10 - 2014-06-13 16:30 - 00000000 ____D () C:\FRST 2014-06-10 13:09 - 2014-06-13 16:30 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 12:57 - 2014-06-10 15:58 - 00000000 ____D () C:\Users\Rolf 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER ==================== One Month Modified Files and Folders ======= 2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion 2014-06-13 16:30 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp 2014-06-13 16:30 - 2014-06-10 13:10 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt 2014-06-13 16:30 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST 2014-06-13 16:30 - 2014-06-10 13:09 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe 2014-06-13 16:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-13 16:23 - 2014-06-12 15:19 - 00000000 ____D () C:\Program Files\ESET 2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe 2014-06-13 16:05 - 2009-12-05 04:40 - 01598358 _____ () C:\windows\WindowsUpdate.log 2014-06-13 16:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-13 15:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job 2014-06-13 12:25 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-13 12:18 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job 2014-06-12 19:45 - 2012-10-25 21:27 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-06-12 15:31 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe 2014-06-12 15:13 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics 2014-06-12 15:11 - 2012-12-03 11:05 - 00018887 _____ () C:\windows\setupact.log 2014-06-12 15:11 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2014-06-12 15:11 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-12 15:07 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-06-12 15:06 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT 2014-06-12 15:01 - 2010-04-27 20:46 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt 2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT 2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt 2014-06-11 16:17 - 2012-12-16 11:56 - 04199370 _____ () C:\windows\PFRO.log 2014-06-11 16:16 - 2014-06-11 16:14 - 00000000 ____D () C:\AdwCleaner 2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe 2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe 2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt 2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-06-11 16:05 - 2014-01-02 17:44 - 00001848 _____ () C:\Users\Anke\Desktop\Amazon.lnk 2014-06-11 16:05 - 2014-01-02 17:44 - 00001846 _____ () C:\Users\Anke\Desktop\WEB.DE.lnk 2014-06-11 16:05 - 2010-04-24 15:56 - 00001371 _____ () C:\Users\Anke\Desktop\Internet Explorer.lnk 2014-06-11 15:49 - 2012-10-16 21:09 - 00000000 ____D () C:\ProgramData\Avira 2014-06-10 17:40 - 2009-12-05 04:46 - 00000000 ____D () C:\ProgramData\Temp 2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software 2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-06-10 16:41 - 2014-03-23 12:24 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300 2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300 2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe 2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys 2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr 2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys 2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software 2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-06-10 16:37 - 2014-06-10 16:36 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe 2014-06-10 15:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf 2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt 2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-10 15:43 - 2014-06-10 15:14 - 00000000 ____D () C:\Qoobox 2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default 2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-06-10 15:41 - 2014-06-10 15:14 - 00000000 ____D () C:\windows\erdnt 2014-06-10 15:40 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini 2014-06-10 15:38 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke 2014-06-10 15:12 - 2014-06-10 15:11 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe 2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk 2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-06-10 15:02 - 2014-06-10 13:19 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt 2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe 2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt 2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME 2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log 2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log 2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log 2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt 2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe 2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt 2014-06-10 13:09 - 2014-06-10 15:01 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe 2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable 2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe 2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI 2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe 2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl Some content of TEMP: ==================== C:\Users\Anke\AppData\Local\temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\windows\explorer.exe => File is digitally signed C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-08 13:56 ==================== End Of Log ============================ --- --- --- --- --- --- Und wie weiss ich jetzt das mein Lappi wieder ok ist? Bin extrem auf Online-Banking angewiesen |
14.06.2014, 15:26 | #8 | |
/// the machine /// TB-Ausbilder | Bankdaten ausgespät, Trojaner entfernen Java und Adobe updaten. Zitat:
Mach die Updates jetzt, solange wiederholen bis keine mehr gefunden werden. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Bankdaten ausgespät, Trojaner entfernen |
antivirus, association, avira, bankdaten ausgespät, browser, defender, desktop, device driver, e-banking, entfernen, flash player, js/securitydisabler.a.gen, lightning, programm, scan, services.exe, software, svchost.exe, trojaner, updates, win32/downloadsponsor.a, win32/malavida.a, win32/toolbar.conduit.y, windows xp |