| |
| |||||||
Log-Analyse und Auswertung: searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-RechnerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
26.06.2014, 20:32
| #16 |
| /// the machine /// TB-Ausbilder    |  searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner lösch die funde, poste dann bitte ein frisches FRST log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.06.2014, 08:12
| #17 |
 | searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner Erledigt ...
__________________(da hatte ich mich aber sehr blond angestellt ... dachte das In-Quarantäne-verschieben reicht, anstatt die Funde dann auch aus der Quarantäne zu löschen) FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:22-06-2014 Ran by Armin (administrator) on ANGELIQUE-PC on 27-06-2014 07:19:33 Running from C:\Users\Armin\Desktop Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe () C:\Windows\System32\Rezip.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe (Secunia) C:\Program Files\Secunia\PSI\psia.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Secunia) C:\Program Files\Secunia\PSI\sua.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe (1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Opera Software) C:\Program Files\Opera\opera.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated) HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink) HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.) HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.) HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.) HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.) HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: F - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {32a285c4-0323-11e1-9b96-0024548754ef} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {4f2ba709-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {4f2ba72a-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {4f2ba786-fd98-11e0-bd08-001e101faa49} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1003\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3595608 2014-06-23] (Electronic Arts) HKU\S-1-5-21-2339853823-2107313754-116825072-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3595608 2014-06-23] (Electronic Arts) HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia) Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Armin\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File) Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File) ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/br/ie11_startpage SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN SearchScopes: HKCU - {0149E807-B987-4E2D-BD54-EDC158FCC679} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere SearchScopes: HKCU - {267EF3C0-6969-4EBB-925C-C129CFC7431B} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {4C7D8CE6-99D1-42C5-A5DC-F15028CF0CE4} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE386 SearchScopes: HKCU - {A82DC977-0F54-4431-88CB-77F900DAD944} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms} SearchScopes: HKCU - {D90868E5-DB4F-41F1-8491-E8922913A21A} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {F3A90CB4-A8AF-447D-9F47-4E22DB5C8DC8} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx DPF: {CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03] FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03] FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03] FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03] FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01] FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR StartupUrls: "hxxp://www.google.com" CHR Extension: (Google Docs) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13] CHR Extension: (Google Drive) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-13] CHR Extension: (YouTube) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13] CHR Extension: (Google-Suche) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13] CHR Extension: (Google Wallet) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13] CHR Extension: (Google Mail) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-13] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG) R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-23] (SurfRight B.V.) R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed] S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed] R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] () S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed] R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed] R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] () R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [97648 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG) S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek ) S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed] R3 PSI; C:\windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia) R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc) R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] () R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib) R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib) S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X] S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X] S3 XDva389; \??\C:\windows\system32\XDva389.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-27 07:19 - 2014-06-27 07:19 - 00020697 _____ () C:\Users\Armin\Desktop\FRST.txt 2014-06-25 07:00 - 2014-06-25 07:04 - 00000000 ____D () C:\AdwCleaner 2014-06-25 06:59 - 2014-06-25 06:59 - 01342659 _____ () C:\Users\Armin\Desktop\adwcleaner_3.213.exe 2014-06-23 20:48 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\OpenOffice 2014-06-23 20:09 - 2014-06-25 07:13 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe 2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe 2014-06-22 21:05 - 2014-06-27 07:19 - 00000000 ____D () C:\FRST 2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe 2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer 2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe 2014-06-20 23:28 - 2014-06-20 23:29 - 00000000 ____D () C:\Program Files\SpywareBlaster 2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk 2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster 2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses 2014-06-20 23:27 - 2014-06-20 23:28 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll 2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe 2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi 2014-06-20 23:03 - 2014-06-20 23:12 - 00000794 _____ () C:\windows\SecuniaPackage.log 2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI 2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk 2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia 2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe 2014-06-20 22:35 - 2014-06-20 22:36 - 00000988 _____ () C:\DelFix.txt 2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP 2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp 2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung 2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro 2014-06-18 18:29 - 2014-06-20 22:35 - 00000000 ____D () C:\windows\ERUNT 2014-06-18 18:22 - 2014-06-26 06:25 - 00003714 _____ () C:\windows\PFRO.log 2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll 2014-06-18 16:26 - 2014-06-27 07:07 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-06-17 10:13 - 2014-06-25 06:54 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin 2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin 2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList 2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList 2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker 2014-06-15 11:20 - 2014-06-26 17:42 - 00001288 _____ () C:\windows\setupact.log 2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD 2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe 2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll 2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys 2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS 2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll 2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll 2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll 2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll 2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt 2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe ==================== One Month Modified Files and Folders ======= 2014-06-27 07:20 - 2014-06-27 07:19 - 00020697 _____ () C:\Users\Armin\Desktop\FRST.txt 2014-06-27 07:19 - 2014-06-22 21:05 - 00000000 ____D () C:\FRST 2014-06-27 07:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job 2014-06-27 07:14 - 2010-03-05 06:29 - 01636738 _____ () C:\windows\WindowsUpdate.log 2014-06-27 07:13 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-27 07:07 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-27 07:04 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin 2014-06-27 07:03 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox 2014-06-27 07:03 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM 2014-06-27 07:03 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-27 06:04 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job 2014-06-26 17:50 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-26 17:50 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-26 17:43 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster 2014-06-26 17:43 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox 2014-06-26 17:43 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM 2014-06-26 17:42 - 2014-06-15 11:20 - 00001288 _____ () C:\windows\setupact.log 2014-06-26 17:42 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-26 06:25 - 2014-06-18 18:22 - 00003714 _____ () C:\windows\PFRO.log 2014-06-26 06:25 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME 2014-06-25 22:54 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin 2014-06-25 22:53 - 2014-05-17 08:18 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2014-06-25 22:51 - 2009-07-14 04:37 - 00000000 ___HD () C:\windows\system32\GroupPolicy 2014-06-25 07:13 - 2014-06-23 20:09 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe 2014-06-25 07:04 - 2014-06-25 07:00 - 00000000 ____D () C:\AdwCleaner 2014-06-25 06:59 - 2014-06-25 06:59 - 01342659 _____ () C:\Users\Armin\Desktop\adwcleaner_3.213.exe 2014-06-25 06:54 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin 2014-06-24 11:01 - 2012-11-30 22:59 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys 2014-06-23 20:59 - 2011-10-23 19:03 - 00000000 ____D () C:\Program Files\Mobile Partner 2014-06-23 20:57 - 2012-12-18 23:58 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Google 2014-06-23 20:48 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\OpenOffice 2014-06-23 20:25 - 2012-12-15 10:10 - 00000000 ____D () C:\Users\Armin\AppData\Local\Google 2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe 2014-06-22 22:00 - 2013-05-29 07:29 - 00000000 ____D () C:\Program Files\Adobe 2014-06-22 21:43 - 2010-06-29 20:57 - 00000000 ____D () C:\Users\Angelique\AppData\Local\Google 2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe 2014-06-21 11:38 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-20 23:54 - 2010-03-05 06:31 - 00000000 ____D () C:\ProgramData\Temp 2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes 2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod 2014-06-20 23:47 - 2011-02-25 19:59 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer 2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer 2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe 2014-06-20 23:29 - 2014-06-20 23:28 - 00000000 ____D () C:\Program Files\SpywareBlaster 2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk 2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster 2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses 2014-06-20 23:28 - 2014-06-20 23:27 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe 2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll 2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-06-20 23:14 - 2011-01-04 11:24 - 00000000 ____D () C:\Program Files\Java 2014-06-20 23:12 - 2014-06-20 23:03 - 00000794 _____ () C:\windows\SecuniaPackage.log 2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe 2014-06-20 23:10 - 2011-02-25 19:59 - 00000000 ____D () C:\ProgramData\Apple 2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi 2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI 2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk 2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia 2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe 2014-06-20 22:36 - 2014-06-20 22:35 - 00000988 _____ () C:\DelFix.txt 2014-06-20 22:35 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT 2014-06-20 22:32 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin 2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP 2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp 2014-06-18 20:19 - 2013-11-18 10:24 - 00000000 ____D () C:\windows\Minidump 2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera 2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung 2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic 2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro 2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja 2014-06-18 18:21 - 2012-12-04 10:52 - 00001162 _____ () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk 2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini 2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique 2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp 2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon 2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration 2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin 2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer 2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList 2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList 2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker 2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD 2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache 2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe 2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner 2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel 2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT 2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt 2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys 2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe Some content of TEMP: ==================== C:\Users\Angelique\AppData\Local\Temp\avgnt.exe C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphyicji.dll C:\Users\Armin\AppData\Local\Temp\avgnt.exe C:\Users\Armin\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\windows\explorer.exe => File is digitally signed C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-18 13:18 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- Ergebnis: Ich kann mich auf einem Profil (nicht das Admin-Profil) nicht mehr normal anmelden, bekomme die Nachricht: Sie wurden mit einem temporären Profil angemeldet ... Shit ... Jetzt hab ich ein großes Problem ... Komme auch an sämtliche Daten/Dokumente, die in diesem Profil erstellt wurden, nicht mehr ran. ENTWARNUNG: Nach komplettem Neustart ist alles wieder gut, kann mich richtig anmelden und auf alle Dateien wieder zugreifen .. puh .. *schwitz* .. das war nicht herzfreundlich  |
|
28.06.2014, 12:41
| #18 |
| /// the machine /// TB-Ausbilder | searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner Quarantäne reicht. Neues Profil einrichten, Daten kopieren, dieses Profil löschen, das gibt bald den Geist auf.
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys
C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig  Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ |
|
30.06.2014, 19:11
| #19 |
| | searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner Erledigt: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:28-06-2014 02
Ran by Armin at 2014-06-30 19:57:32 Run:2
Running from C:\Users\Armin\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys
C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys
*****************
{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw => Service stopped successfully.
{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw => Service deleted successfully.
{e63d9559-e4c3-499e-867a-a3c9d0a21400}w => Service stopped successfully.
{e63d9559-e4c3-499e-867a-a3c9d0a21400}w => Service deleted successfully.
C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys => Moved successfully.
C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys => Moved successfully.
==== End of Fixlog ====
Ich denke, wir sind hier fertig ... keine weiteren Sorgen. |
|
01.07.2014, 13:32
| #20 |
| /// the machine /// TB-Ausbilder | searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
