|
Log-Analyse und Auswertung: Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\LocalWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
31.12.2014, 20:11 | #16 |
| Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local sieht nur schon sehr gut aus FRST siehe unten. Beim Systemstart bekomme ich noch die im Screenshot zu sehende (oder eine ähnliche) Warnmeldung. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014 Ran by Admin (administrator) on ADMIN-PC on 31-12-2014 19:08:16 Running from C:\Users\Admin\Desktop Loaded Profile: Admin (Available profiles: Admin) Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (AMD) C:\Windows\System32\atieclxx.exe (SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (VIA Technologies, Inc.) C:\VIA_XHCI\usb3Monitor.exe (Greenshot) C:\Program Files\Greenshot\Greenshot.exe (Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Azureus Software, Inc) C:\Program Files\Vuze\Azureus.exe (Schnapper-Software Robert Beer) C:\Program Files (x86)\SchnapperPro\TimeSync.exe (Spotify Ltd) C:\Users\Admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Schnapper-Software Robert Beer) C:\Program Files (x86)\SchnapperPro\SchnapperPro.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Nero AG) C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Dropbox, Inc.) C:\Users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe (WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (SAP AG) C:\Program Files (x86)\SAP\SapSetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Microsoft Corporation) C:\Windows\splwow64.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [VIAxHCUtl] => C:\VIA_XHCI\usb3Monitor.exe [331776 2012-03-26] (VIA Technologies, Inc.) HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2014-05-12] (Greenshot) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1234216 2010-03-26] (Nero AG) HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.) HKU\S-1-5-21-3347311179-4269016646-269938500-1000\...\Run: [Azureus] => C:\Program Files\Vuze\Azureus.exe [346424 2014-08-12] (Azureus Software, Inc) HKU\S-1-5-21-3347311179-4269016646-269938500-1000\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-24] (Spotify Ltd) HKU\S-1-5-21-3347311179-4269016646-269938500-1000\...\Run: [UVMmedia] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Admin\AppData\Local\Idsoft\EP0LB03B.DLL AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.) Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SchnapperPro.lnk ShortcutTarget: SchnapperPro.lnk -> C:\Program Files (x86)\SchnapperPro\SchnapperPro.exe (Schnapper-Software Robert Beer) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-3347311179-4269016646-269938500-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf) Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP, Walldorf) Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 FireFox: ======== FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k61t38wy.default-1409423412364 FF SelectedSearchEngine: Google FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin HKU\S-1-5-21-3347311179-4269016646-269938500-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Admin\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online) FF Extension: WMDM CE Device Service Provider - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lo553pk.default\Extensions\{066BF1A1-62A1-474B-4D00-591822FEB978} [2014-12-26] FF Extension: WMDM CE Device Service Provider - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k61t38wy.default-1409423412364\Extensions\{066BF1A1-62A1-474B-4D00-591822FEB978} [2014-12-26] Chrome: ======= ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 a2AntiMalware; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2service.exe [4907232 2014-12-01] (Emsisoft GmbH) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-12-25] (SurfRight B.V.) R2 NWSAPAutoWorkstationUpdateSvc; C:\Program Files (x86)\SAP\SAPsetup\Setup\Updater\NwSapAutoWorkstationUpdateService.exe [165568 2012-06-19] (SAP AG) R2 SchnapperPro-TimeSync; C:\Program Files (x86)\SchnapperPro\TimeSync.exe [45664 2007-08-30] (Schnapper-Software Robert Beer) S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-12] (Emsisoft GmbH) R1 A2DDA; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH) R1 a2injectiondriver; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH) R1 a2util; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2util64.sys [23088 2014-05-12] (Emsisoft GmbH) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-01] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-01] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-24] (Avira Operations GmbH & Co. KG) R3 cleanhlp; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH) R2 ei2c; C:\Windows\system32\drivers\ei2c.sys [20784 2014-08-30] (Nicomsoft Ltd.) S3 gbxavs; C:\Windows\System32\Drivers\gbxavs.sys [357968 2011-07-07] () [File not signed] S3 gbxavs_x64; C:\Windows\System32\Drivers\gbxavs_x64.sys [46096 2008-11-20] (Native Instruments GmbH) S3 gbxusb_x64; C:\Windows\System32\Drivers\gbxusb_x64.sys [250896 2008-11-20] (Native Instruments GmbH) S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2014-12-30] () R3 ka6avs; C:\Windows\System32\Drivers\ka6avs.sys [359784 2012-12-18] (Native Instruments GmbH) R3 ka6usb_svc; C:\Windows\System32\Drivers\ka6usb.sys [85864 2012-12-18] (Native Instruments GmbH) S3 rspLLL; C:\Windows\System32\DRIVERS\rspLLL64.sys [23968 2013-02-07] (Resplendence Software Projects Sp.) S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [53760 2012-09-28] (Apple, Inc.) [File not signed] R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [204800 2012-03-26] (VIA Technologies, Inc.) R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [256000 2012-03-26] (VIA Technologies, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X] S3 tsusbhub; system32\drivers\tsusbhub.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-31 15:50 - 2014-12-31 15:50 - 00000004 ____H () C:\ProgramData\cm-lock 2014-12-30 18:50 - 2014-12-30 18:50 - 00043664 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys 2014-12-30 06:51 - 2014-12-30 18:42 - 00049733 _____ () C:\Users\Admin\Desktop\Addition.txt 2014-12-30 06:50 - 2014-12-31 19:08 - 00016544 _____ () C:\Users\Admin\Desktop\FRST.txt 2014-12-30 06:50 - 2014-12-30 06:50 - 00000760 _____ () C:\Users\Admin\Desktop\securitycheck.txt 2014-12-30 06:23 - 2014-12-30 06:23 - 00852505 _____ () C:\Users\Admin\Desktop\SecurityCheck(1).exe 2014-12-29 22:25 - 2014-12-29 22:25 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_deu(1).exe 2014-12-29 06:46 - 2014-12-29 06:46 - 00000000 ____D () C:\Users\Admin\Desktop\FRST-OlderVersion 2014-12-29 06:41 - 2014-12-28 09:01 - 01707939 _____ (Thisisu) C:\Users\Admin\Desktop\JRT_NEW.exe 2014-12-29 06:39 - 2014-12-29 06:39 - 00001500 _____ () C:\Users\Admin\Desktop\AdwCleaner[S4].txt 2014-12-28 22:28 - 2014-12-28 22:29 - 00000000 ____D () C:\Users\Admin\Desktop\mal 2014-12-28 22:26 - 2014-12-28 22:26 - 00000270 _____ () C:\Users\Admin\Desktop\text.txt 2014-12-28 12:14 - 2014-12-28 12:14 - 00025716 _____ () C:\ComboFix.txt 2014-12-26 14:47 - 2014-12-26 14:47 - 00715952 _____ () C:\Windows\Minidump\122614-37533-01.dmp 2014-12-26 13:43 - 2014-12-26 13:43 - 01180834 _____ () C:\Users\Admin\Downloads\7z935.exe 2014-12-26 13:43 - 2014-12-26 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2014-12-26 13:43 - 2014-12-26 13:43 - 00000000 ____D () C:\Program Files (x86)\7-Zip 2014-12-26 12:04 - 2014-12-26 12:04 - 00380416 _____ () C:\Users\Admin\Downloads\Gmer-19357.exe 2014-12-26 11:59 - 2014-12-26 11:59 - 00000000 _____ () C:\Users\Admin\defogger_reenable 2014-12-26 11:58 - 2014-12-26 11:59 - 00050477 _____ () C:\Users\Admin\Desktop\Defogger.exe 2014-12-26 11:48 - 2014-12-26 11:48 - 00003874 _____ () C:\EamClean.log 2014-12-26 00:41 - 2014-12-26 00:41 - 00852505 _____ () C:\Users\Admin\Downloads\SecurityCheck.exe 2014-12-26 00:39 - 2014-12-26 00:39 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-12-26 00:38 - 2014-12-26 00:38 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_deu.exe 2014-12-26 00:36 - 2014-12-31 19:08 - 00000000 ____D () C:\FRST 2014-12-26 00:36 - 2014-12-26 11:41 - 00044595 _____ () C:\Users\Admin\Downloads\FRST.txt 2014-12-26 00:36 - 2014-12-26 00:37 - 00037320 _____ () C:\Users\Admin\Downloads\Addition.txt 2014-12-26 00:20 - 2014-12-29 06:46 - 02123264 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe 2014-12-25 23:53 - 2014-12-25 23:24 - 05603624 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe 2014-12-25 23:51 - 2014-12-25 23:51 - 00709564 _____ () C:\Users\Admin\Downloads\delfix_10.8.exe 2014-12-25 23:26 - 2014-12-28 12:15 - 00000000 ____D () C:\Qoobox 2014-12-25 23:26 - 2014-12-25 23:47 - 00000000 ____D () C:\Windows\erdnt 2014-12-25 23:26 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-12-25 23:26 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-12-25 23:26 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-12-25 23:26 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-12-25 23:26 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-12-25 23:26 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-12-25 23:26 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-12-25 23:26 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-12-25 23:24 - 2014-12-25 23:24 - 05603624 ____R (Swearware) C:\Users\Admin\Downloads\ComboFix.exe 2014-12-25 17:05 - 2014-12-25 17:05 - 00001098 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2014-12-25 17:05 - 2014-12-25 17:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware 2014-12-25 17:04 - 2014-12-31 15:52 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2014-12-25 16:51 - 2014-12-25 16:54 - 170741736 _____ (Emsisoft Ltd ) C:\Users\Admin\Downloads\EmsisoftAntiMalwareSetup.exe 2014-12-25 13:48 - 2014-12-30 18:48 - 00000918 _____ () C:\Windows\system32\.crusader 2014-12-25 13:38 - 2014-12-25 13:49 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-12-25 13:38 - 2014-12-25 13:38 - 00001912 _____ () C:\Users\Public\Desktop\HitmanPro.lnk 2014-12-25 13:38 - 2014-12-25 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2014-12-25 13:38 - 2014-12-25 13:38 - 00000000 ____D () C:\Program Files\HitmanPro 2014-12-25 13:04 - 2014-12-25 13:05 - 11222744 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro_x64.exe 2014-12-25 12:18 - 2014-12-25 12:18 - 00000194 _____ () C:\Users\Admin\Downloads\hosts-perm.bat 2014-12-25 11:11 - 2014-12-25 11:11 - 01061112 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\blabka4.exe 2014-12-24 17:17 - 2014-12-24 17:17 - 00001801 _____ () C:\Users\Public\Desktop\Vuze.lnk 2014-12-24 16:43 - 2014-12-24 16:43 - 02953520 _____ (AVAST Software) C:\Users\Admin\Downloads\avast-browser-cleanup.exe 2014-12-24 16:34 - 2014-12-24 16:34 - 00000000 ____D () C:\Windows\ERUNT 2014-12-24 16:04 - 2014-12-31 18:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-24 16:04 - 2014-12-24 16:04 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-24 16:04 - 2014-12-24 16:04 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-24 16:04 - 2014-12-24 16:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-24 14:11 - 2014-12-24 14:11 - 00001271 _____ () C:\Users\Admin\Desktop\Revo Uninstaller.lnk 2014-12-24 14:11 - 2014-12-24 14:11 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-12-24 14:10 - 2014-12-24 14:10 - 01707646 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe 2014-12-24 14:09 - 2014-12-24 14:09 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Admin\Downloads\revosetup.exe 2014-12-24 14:08 - 2014-12-24 14:08 - 01940728 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill.exe 2014-12-24 13:50 - 2014-12-24 13:50 - 02173952 _____ () C:\Users\Admin\Desktop\AdwCleaner_4.106.exe 2014-12-19 13:46 - 2014-12-19 13:46 - 00001723 _____ () C:\Users\Admin\Desktop\Computer.lnk 2014-12-18 08:52 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 08:52 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-17 22:17 - 2014-12-17 22:17 - 00003133 _____ () C:\Users\Public\Desktop\Nero BackItUp 10.lnk 2014-12-17 22:16 - 2014-12-17 22:16 - 00002937 _____ () C:\Users\Public\Desktop\Nero Burning ROM 10.lnk 2014-12-17 22:14 - 2014-12-17 22:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 2014-12-17 20:59 - 2014-12-17 21:06 - 00000000 ____D () C:\Users\Admin\Desktop\volvo verkauf autoscout 2014-12-17 19:39 - 2014-12-17 19:39 - 00001156 _____ () C:\Users\Public\Desktop\etope 8 starten.lnk 2014-12-16 22:06 - 2014-12-24 14:17 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Line 6 2014-12-16 22:05 - 2014-12-17 18:49 - 00001137 _____ () C:\Users\Public\Desktop\Reason Essentials.lnk 2014-12-16 22:05 - 2014-12-16 22:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CodeMeter 2014-12-16 22:05 - 2014-12-16 22:06 - 00000000 ____D () C:\Program Files (x86)\CodeMeter 2014-12-16 22:05 - 2014-12-16 22:05 - 00000000 ____D () C:\ProgramData\CodeMeter 2014-12-16 22:05 - 2014-12-16 22:05 - 00000000 ____D () C:\Program Files\Propellerhead 2014-12-16 22:05 - 2014-12-16 22:05 - 00000000 ____D () C:\Program Files\CodeMeter 2014-12-16 19:49 - 2014-12-16 19:49 - 00000000 ____D () C:\Windows\pss 2014-12-16 19:13 - 2014-12-16 19:13 - 00000000 ____D () C:\ProgramData\Adobe Systems 2014-12-16 18:29 - 2014-12-16 18:29 - 02166272 _____ () C:\Users\Admin\Downloads\adwcleaner_4.105.exe 2014-12-16 18:28 - 2014-12-29 06:31 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-16 18:28 - 2014-12-16 18:28 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-16 18:28 - 2014-12-16 18:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-16 18:28 - 2014-12-16 18:28 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-16 18:28 - 2014-12-16 18:28 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-16 18:28 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-16 18:28 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-16 18:28 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-16 18:27 - 2014-12-16 18:27 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-11 03:24 - 2014-12-11 03:24 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-11 03:02 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-11 03:02 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-10 19:37 - 2014-12-16 20:05 - 00000000 _____ () C:\ProgramData\@system.temp 2014-12-10 19:36 - 2014-12-16 20:30 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\FrameworkUpdate 2014-12-10 19:36 - 2014-12-10 19:36 - 00000480 ____H () C:\Users\Admin\AppData\Roaming\麽鎒駓覜 2014-12-10 08:43 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-10 08:43 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-10 08:43 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-10 08:43 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-10 08:43 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-10 08:43 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-10 08:43 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-10 08:43 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2014-12-10 08:42 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-10 08:42 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-10 08:42 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 08:42 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-10 08:42 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-10 08:42 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 08:42 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-10 08:42 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 08:42 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-10 08:42 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-10 08:42 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-10 08:42 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-10 08:42 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-10 08:42 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-10 08:42 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-10 08:42 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-10 08:42 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-10 08:42 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-10 08:42 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-10 08:42 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-10 08:42 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-10 08:42 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-10 08:42 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 08:42 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-10 08:42 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-10 08:42 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-10 08:42 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 08:42 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-10 08:42 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-10 08:42 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-10 08:42 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-10 08:42 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-10 08:42 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-10 08:42 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 08:42 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-10 08:42 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-10 08:42 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 08:42 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-10 08:42 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 08:42 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-10 08:42 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-10 08:42 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-10 08:42 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-10 08:42 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-10 08:42 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 08:42 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-10 08:42 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-10 08:42 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-10 08:42 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 08:42 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-10 08:42 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 08:42 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-10 08:42 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-10 08:42 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-10 08:42 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 08:42 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-10 08:42 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-10 08:42 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-10 08:42 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-10 08:42 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-10 08:42 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-10 08:42 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-10 08:42 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-10 08:42 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-10 08:42 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-10 08:42 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-10 08:42 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-10 08:42 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-10 08:42 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-10 08:41 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-10 08:41 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-09 21:04 - 2014-12-09 21:04 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Oracle 2014-12-09 09:14 - 2014-12-09 09:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-12-08 19:34 - 2014-12-08 19:34 - 00000000 ____D () C:\ProgramData\PACE 2014-12-08 19:19 - 2014-12-24 14:22 - 00000000 ____D () C:\Users\Admin\Documents\iZotope 2014-12-08 19:12 - 2014-12-28 22:03 - 00000000 ____D () C:\Users\Admin\AppData\Local\Ejmtion 2014-12-07 00:22 - 2014-12-07 00:22 - 01389910 _____ () C:\Users\Admin\Downloads\mp3bee3.exe 2014-12-06 20:08 - 2014-12-06 20:08 - 00025478 _____ () C:\Users\Admin\Desktop\1131_I-Wont-be-Home-for-Christmas.mid 2014-12-06 20:04 - 2014-12-06 20:04 - 00028918 _____ () C:\Users\Admin\Desktop\Blink_182_-_I_Won't_Be_Home_for_Christmas.mid 2014-12-02 22:14 - 2014-12-02 22:14 - 04990667 _____ () C:\Users\Admin\Desktop\10433298_10204168401239201_2025431251_n.mp4 ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-31 19:08 - 2013-03-31 16:13 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Azureus 2014-12-31 16:37 - 2013-03-31 00:28 - 01989796 _____ () C:\Windows\WindowsUpdate.log 2014-12-31 15:59 - 2009-07-14 05:45 - 00020880 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-31 15:59 - 2009-07-14 05:45 - 00020880 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-31 15:56 - 2009-07-14 18:58 - 00702980 _____ () C:\Windows\system32\perfh007.dat 2014-12-31 15:56 - 2009-07-14 18:58 - 00150620 _____ () C:\Windows\system32\perfc007.dat 2014-12-31 15:56 - 2009-07-14 06:13 - 01629444 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-31 15:51 - 2013-04-04 20:00 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\SchnapperPro 2014-12-31 15:51 - 2013-04-03 21:41 - 00000000 ___RD () C:\Users\Admin\Dropbox 2014-12-31 15:51 - 2013-04-03 21:39 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Dropbox 2014-12-31 15:50 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-31 15:49 - 2013-05-01 22:29 - 00269540 _____ () C:\Windows\setupact.log 2014-12-31 14:11 - 2013-03-31 14:01 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc 2014-12-31 13:59 - 2014-11-16 23:37 - 00000000 ____D () C:\Users\Admin\AppData\Local\JDownloader 2.0 2014-12-31 04:26 - 2013-03-30 18:07 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2D7B81C1-8B06-4916-B13D-931EF0D2FBD7} 2014-12-31 02:00 - 2013-04-01 11:56 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe 2014-12-29 16:31 - 2013-05-01 22:28 - 00232502 _____ () C:\Windows\PFRO.log 2014-12-29 06:33 - 2014-08-30 17:51 - 00000000 ____D () C:\AdwCleaner 2014-12-28 11:47 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-12-26 14:47 - 2013-10-18 05:16 - 1811278370 _____ () C:\Windows\MEMORY.DMP 2014-12-26 14:47 - 2013-04-05 16:37 - 00000000 ____D () C:\Windows\Minidump 2014-12-26 11:59 - 2013-03-30 17:29 - 00000000 ____D () C:\Users\Admin 2014-12-25 23:49 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-12-25 13:50 - 2013-06-21 18:50 - 00000000 ____D () C:\Users\Admin\AppData\Local\Greenshot 2014-12-25 12:47 - 2014-02-26 03:02 - 01648918 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-12-25 11:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2014-12-24 17:17 - 2013-03-31 16:13 - 00001801 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk 2014-12-24 17:17 - 2013-03-31 16:13 - 00000000 ____D () C:\Program Files\Vuze 2014-12-24 14:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help 2014-12-24 14:27 - 2014-08-05 17:48 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-24 14:24 - 2013-03-30 17:59 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-12-24 14:22 - 2013-04-05 18:08 - 00000000 ____D () C:\Program Files\Common Files\VST3 2014-12-24 14:21 - 2013-04-07 10:11 - 00000000 ____D () C:\Program Files (x86)\Java 2014-12-24 14:18 - 2013-03-31 16:23 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-12-24 14:18 - 2013-03-31 03:19 - 00000000 ____D () C:\ProgramData\Adobe 2014-12-24 14:14 - 2013-04-01 08:35 - 00000000 ____D () C:\Users\Admin\AppData\Local\Citrix 2014-12-24 14:00 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors 2014-12-20 21:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\L2Schemas 2014-12-19 14:11 - 2013-03-31 00:23 - 00000000 ____D () C:\Windows\Panther 2014-12-19 14:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas 2014-12-18 20:14 - 2013-05-18 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Spotify 2014-12-18 15:55 - 2013-05-18 11:33 - 00000000 ____D () C:\Users\Admin\AppData\Local\Spotify 2014-12-18 14:55 - 2014-11-30 12:59 - 00000000 ____D () C:\Users\Admin\Desktop\facebook 2014-12-17 22:21 - 2013-04-01 18:04 - 00000000 ____D () C:\Program Files (x86)\Nero 2014-12-17 21:55 - 2014-08-30 12:41 - 00000000 ____D () C:\Temp 2014-12-17 19:39 - 2014-04-27 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\etope 8 2014-12-16 22:14 - 2009-07-14 05:45 - 11266360 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-16 22:13 - 2013-05-01 10:12 - 00000000 ____D () C:\ProgramData\Propellerhead Software 2014-12-16 22:08 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports 2014-12-16 22:06 - 2013-05-01 10:12 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Propellerhead Software 2014-12-16 22:05 - 2013-05-01 10:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Propellerhead 2014-12-16 19:53 - 2014-09-13 16:03 - 00000000 ____D () C:\Program Files (x86)\AntiTwin 2014-12-16 19:47 - 2013-06-19 18:24 - 00000000 ____D () C:\Program Files\ARIS Express 2014-12-16 19:40 - 2013-03-30 17:44 - 00440744 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-16 19:15 - 2013-03-30 18:29 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Adobe 2014-12-16 19:12 - 2013-03-31 16:04 - 00000000 ____D () C:\Program Files (x86)\JDownloader 2014-12-16 19:11 - 2013-09-01 20:02 - 00000000 ____D () C:\Users\Admin\.android 2014-12-14 03:00 - 2013-03-30 17:34 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-13 03:22 - 2013-08-30 17:11 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-12-11 03:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-11 03:26 - 2014-08-30 15:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-11 03:24 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-11 03:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-11 03:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat 2014-12-11 03:07 - 2013-07-23 02:00 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-11 03:04 - 2013-03-30 20:21 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-09 21:04 - 2013-11-24 11:03 - 00000000 ____D () C:\ProgramData\Oracle 2014-12-09 20:08 - 2014-11-03 17:17 - 00001144 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-12-09 20:08 - 2013-03-31 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-12-09 20:08 - 2013-03-31 13:43 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-09 20:02 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-08 19:44 - 2013-04-01 15:27 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\iZotope 2014-12-08 12:29 - 2014-11-30 16:23 - 00000000 ____D () C:\Users\Admin\Desktop\5825 2014-12-07 12:06 - 2014-05-01 10:37 - 00022016 ___SH () C:\Users\Admin\Thumbs.db Some content of TEMP: ==================== C:\Users\Admin\AppData\Local\Temp\avgnt.exe C:\Users\Admin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpflmzbb.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-25 07:54 ==================== End Of Log ============================ --- --- --- |
31.12.2014, 22:20 | #17 |
/// the machine /// TB-Ausbilder | Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.
__________________Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-3347311179-4269016646-269938500-1000\...\Run: [UVMmedia] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Admin\AppData\Local\Idsoft\EP0LB03B.DLL C:\Users\Admin\AppData\Local\Idsoft Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Sollte jetzt Ruhe sein.
__________________ |
01.01.2015, 16:09 | #18 |
| Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local wow, sieht nun sehr gut aus, bekomme keine meldungen mehr.
__________________Vielen, vielen Dank für die Spitzen Hilfe!!! |
01.01.2015, 16:53 | #19 |
/// the machine /// TB-Ausbilder | Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
14.02.2015, 12:43 | #20 |
| Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local Bestens, seither keine Probleme mehr. Vielen, vielen Dank! |
14.02.2015, 17:16 | #21 |
/// the machine /// TB-Ausbilder | Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local Gern Geschehen
__________________ --> Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local |
Themen zu Windows 7: Trojaner z.B. in C:\Users\Admin\AppData\Local |
appdata, exe-dateien, explorer, file, gen, icons, iexplore.exe, internet, internet explorer, löschen, manager, microsoft, nicht löschen, nicht mehr, nichts, ordner, problem, prozesse, secure, tan, task manager, temp, trojaner, windows, windows 7 |