Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Win32/Conduit.SearchProtect.H

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

 
Alt 19.01.2015, 04:14   #1
schaule
 
Win32/Conduit.SearchProtect.H - Standard

Win32/Conduit.SearchProtect.H



Hallo ich habe beim Eset online Scanner die Meldung bekomme das ich die obengeannte malware aufm Rechner habe ,
Kann mir da jemand helfen wie ich die wieder loskriege.
Hier der Frst Log


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 03
Ran by Florian (administrator) on FLORIAN-PC on 19-01-2015 01:41:42
Running from D:\Installationsprogramme\Antivirensoftware
Loaded Profiles: Florian (Available profiles: Florian)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(TeamViewer GmbH) D:\Programme\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
() C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe
(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\javaw.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe
(Malwarebytes Corporation) D:\Programme\Malwarebytes\ Malwarebytes Anti-Malware \mbam.exe
(Malwarebytes Corporation) D:\Programme\Malwarebytes\mbar\mbar\mbar.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-06] (Realtek Semiconductor)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1609296 2010-06-26] (Logitech, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [696320 2011-11-18] ()
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2012-08-24] (AVM Berlin)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> DefaultScope {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1211151.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.450 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.448 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\ebay-kleinanzeigen-.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\myvideo.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube.xml
FF Extension: Avira Browser Safety - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\abs@avira.com [2014-12-12]
FF Extension: German Dictionary - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\de-DE@dictionaries.addons.mozilla.org [2014-08-16]
FF Extension: DownloadHelper - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Add to Search Bar - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\add-to-searchbox@maltekraus.de.xpi [2014-08-16]
FF Extension: Classic Theme Restorer - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-08-16]
FF Extension: Get Mail Plus [de] - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\getmail@webdesigns.ms11.net.xpi [2014-08-16]
FF Extension: Linky - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\linky@gemal.dk.xpi [2014-08-16]
FF Extension: Hide Tab Bar With One Tab - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi [2014-08-16]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [nphjeokkkbngjpiofnfpnafjeofjomfb] - C:\Users\Florian\AppData\LocalLow\WOT\CHROME\WOT.crx [2012-01-12]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393032 2013-06-19] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384840 2013-06-19] (BlueStack Systems, Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
S3 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [633856 2011-06-08] (Nokia) [File not signed]
S3 TDslMgrService; D:\Programme\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) [File not signed]
R2 TeamViewer; D:\Programme\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607040 2010-10-27] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403200 2010-09-30] (TuneUp Software)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WOTUpdater; C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-08-24] (AVM Berlin)
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [30208 2006-11-07] (AVM GmbH) [File not signed]
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [70984 2013-06-19] (BlueStack Systems)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-24] (AVM GmbH)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [91352 2015-01-19] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-19] (Malwarebytes Corporation)
S3 PciDumpr; C:\Program Files (x86)\Common Files\T-Com\DSLCheck\PciDumpr.sys [2144 2001-01-26] () [File not signed]
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-24] (TuneUp Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-15 18:39 - 2015-01-15 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-14 19:16 - 2015-01-14 19:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-14 18:08 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 18:08 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 18:08 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 18:08 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 18:08 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 18:08 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 18:08 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 18:05 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 18:05 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 18:05 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 18:05 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 18:05 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 18:05 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-12 22:29 - 2015-01-12 22:30 - 00000000 ____D () C:\Users\Florian\Downloads\Bearbeiten für JHV
2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-28 15:37 - 2014-12-28 15:37 - 00000669 _____ () C:\Users\Florian\Desktop\teXXas.lnk
2014-12-25 21:34 - 2014-12-25 21:34 - 00000000 ____D () C:\Users\Florian\Documents\eRightSoft
2014-12-22 20:23 - 2014-12-22 20:23 - 00017044 ____N () C:\Users\Florian\Haus Farbenliste.odt
2014-12-20 19:26 - 2014-12-20 19:26 - 00001468 _____ () C:\Users\Public\Desktop\LibreOffice 4.2.lnk
2014-12-20 19:26 - 2014-12-20 19:26 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-19 01:41 - 2014-08-24 20:37 - 00000000 ____D () C:\FRST
2015-01-19 01:35 - 2014-01-05 23:18 - 00000000 ____D () C:\AdwCleaner
2015-01-19 01:26 - 2014-08-24 21:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-19 01:24 - 2010-05-12 20:21 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{61D97D25-2BEF-4AEC-A94F-510529E28523}
2015-01-19 01:14 - 2012-03-25 12:31 - 00083119 _____ () C:\Users\Florian\Fahrtenbuch.ods
2015-01-19 01:14 - 2010-05-09 12:35 - 00000000 ____D () C:\Users\Florian
2015-01-19 00:57 - 2014-12-14 00:15 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-19 00:54 - 2012-12-02 23:26 - 00000000 ____D () C:\Users\Florian\.BH
2015-01-19 00:54 - 2012-07-08 01:26 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-19 00:46 - 2012-08-15 17:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 00:18 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-19 00:18 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-19 00:14 - 2014-06-29 17:52 - 01734196 _____ () C:\Windows\WindowsUpdate.log
2015-01-19 00:10 - 2014-10-05 18:31 - 00117602 _____ () C:\Windows\PFRO.log
2015-01-19 00:10 - 2014-10-05 00:00 - 04034561 _____ () C:\Windows\setupact.log
2015-01-19 00:10 - 2012-07-08 01:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-19 00:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-18 14:17 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Verzeichnisse
2015-01-18 02:43 - 2014-08-17 14:14 - 00000000 ____D () C:\Users\Florian\dwhelper
2015-01-17 21:07 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Internet
2015-01-17 19:28 - 2010-12-19 00:56 - 00000000 __SHD () C:\Users\Florian\wc
2015-01-17 16:49 - 2014-01-06 03:24 - 00181248 _____ () C:\Users\Florian\Einausgaben.xls
2015-01-17 00:05 - 2013-09-30 20:39 - 00095232 _____ () C:\Users\Florian\Arbeitszeitnachweis.xls
2015-01-16 23:29 - 2011-12-20 19:18 - 00000099 _____ () C:\Users\Public\LMDebug.log
2015-01-15 23:14 - 2012-10-31 19:42 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc
2015-01-15 22:31 - 2012-05-05 15:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-15 20:36 - 2009-07-14 18:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-01-15 20:36 - 2009-07-14 18:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-01-15 20:36 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-15 20:35 - 2014-10-29 19:53 - 00000000 ____D () C:\Users\Florian\Freundeskreis
2015-01-15 20:30 - 2010-05-13 23:41 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\VSO
2015-01-15 20:09 - 2012-08-15 17:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-15 20:09 - 2012-03-30 13:31 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-15 20:09 - 2012-01-14 19:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-15 20:09 - 2010-05-13 16:52 - 01025024 ___SH () C:\Users\Florian\Thumbs.db
2015-01-14 19:58 - 2013-07-18 14:49 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 19:54 - 2010-05-13 14:03 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 19:23 - 2010-05-13 20:38 - 00077981 _____ () C:\Windows\cdplayer.ini
2015-01-13 19:02 - 2014-01-06 02:51 - 00028851 _____ () C:\Users\Florian\Haus Zählerstände Haus.ods
2015-01-11 16:31 - 2012-09-09 16:34 - 00000000 ____D () C:\Users\Florian\AppData\Local\CrashDumps
2015-01-10 18:24 - 2014-06-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-01-10 18:24 - 2010-05-13 14:13 - 00000000 ____D () C:\Program Files (x86)\TomTom HOME 2
2015-01-10 18:23 - 2010-07-08 13:11 - 00000000 ____D () C:\Users\Florian\AppData\Local\Downloaded Installations
2015-01-10 15:24 - 2010-05-13 21:57 - 00000000 ____D () C:\ProgramData\DVD Shrink
2015-01-07 00:35 - 2011-06-09 20:07 - 00000000 ____D () C:\ProgramData\tmp
2015-01-07 00:23 - 2010-05-10 18:41 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2015-01-05 15:46 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-01-03 01:13 - 2010-05-14 13:52 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Winamp
2015-01-03 01:13 - 2010-05-10 18:14 - 00000000 ____D () C:\ProgramData\CanonIJ
2015-01-03 01:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-02 01:16 - 2010-05-14 12:57 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Media Player Classic
2014-12-28 17:56 - 2009-07-14 05:45 - 00673912 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-28 16:54 - 2014-08-12 23:56 - 00121688 _____ () C:\Users\Florian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-26 02:16 - 2010-06-06 18:20 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-25 22:52 - 2014-07-26 17:40 - 00000691 _____ () C:\Users\Public\Desktop\dm-Fotowelt.lnk
2014-12-22 20:53 - 2012-12-02 14:32 - 00040645 ____N () C:\Users\Florian\Kalender.ods
2014-12-22 20:51 - 2012-11-01 22:12 - 00112898 ____N () C:\Users\Florian\geburtstagskalender.ods
2014-12-22 20:47 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\cover
2014-12-20 20:23 - 2010-11-07 22:34 - 00000673 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-12-20 19:26 - 2014-02-17 21:19 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4

==================== Files in the root of some directories =======
2010-05-28 18:58 - 2013-05-12 21:00 - 0000192 _____ () C:\Users\Florian\AppData\Roaming\default.rss
2010-05-28 18:58 - 2010-05-28 18:58 - 0000000 _____ () C:\Users\Florian\AppData\Roaming\downloads.m3u
2014-08-17 11:56 - 2014-11-28 18:57 - 0015360 _____ () C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-07-02 21:31 - 2010-07-02 21:32 - 0000333 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\avgnt.exe
C:\Users\Florian\AppData\Local\Temp\RegSvr32User.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-14 18:17

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---


hier noch der GMER file


Code:
ATTFilter
MER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-19 04:06:46
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000062 Hitachi_ rev.ST6O 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Florian\AppData\Local\Temp\pwdiyfob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448                                                                                                                                fffff800033b0000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495                                                                                                                                fffff800033b002f 23 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                      0000000076571401 2 bytes JMP 7725b21b C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                        0000000076571419 2 bytes JMP 7725b346 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                      0000000076571431 2 bytes JMP 772d8ea9 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                      000000007657144a 2 bytes CALL 772348ad C:\Windows\syswow64\KERNEL32.dll
.text     ...                                                                                                                                                                                               * 9
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                         00000000765714dd 2 bytes JMP 772d87a2 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                  00000000765714f5 2 bytes JMP 772d8978 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                         000000007657150d 2 bytes JMP 772d8698 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                  0000000076571525 2 bytes JMP 772d8a62 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                        000000007657153d 2 bytes JMP 7724fca8 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                             0000000076571555 2 bytes JMP 772568ef C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                      000000007657156d 2 bytes JMP 772d8f61 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                        0000000076571585 2 bytes JMP 772d8ac2 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                           000000007657159d 2 bytes JMP 772d865c C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                        00000000765715b5 2 bytes JMP 7724fd41 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                      00000000765715cd 2 bytes JMP 7725b2dc C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                  00000000765716b2 2 bytes JMP 772d8e24 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                  00000000765716bd 2 bytes JMP 772d85f1 C:\Windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                      0000000076571401 2 bytes JMP 7725b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                        0000000076571419 2 bytes JMP 7725b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                      0000000076571431 2 bytes JMP 772d8ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                      000000007657144a 2 bytes CALL 772348ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                               * 9
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                         00000000765714dd 2 bytes JMP 772d87a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                  00000000765714f5 2 bytes JMP 772d8978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                         000000007657150d 2 bytes JMP 772d8698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                  0000000076571525 2 bytes JMP 772d8a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                        000000007657153d 2 bytes JMP 7724fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                             0000000076571555 2 bytes JMP 772568ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                      000000007657156d 2 bytes JMP 772d8f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                        0000000076571585 2 bytes JMP 772d8ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                           000000007657159d 2 bytes JMP 772d865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                        00000000765715b5 2 bytes JMP 7724fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                      00000000765715cd 2 bytes JMP 7725b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                  00000000765716b2 2 bytes JMP 772d8e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                  00000000765716bd 2 bytes JMP 772d85f1 C:\Windows\syswow64\kernel32.dll
---- Processes - GMER 2.1 ----

Process   C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe (*** suspicious ***) @ C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe [2492](2012-01-12 10:23:20)                                0000000000120000

---- Registry - GMER 2.1 ----

Reg       HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Florian\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- EOF - GMER 2.1 ----
         



Malwarebyte gibt die meldung das es an der Datei CltMngSVC.exe liegt

Geändert von schaule (19.01.2015 um 04:53 Uhr)

 

Themen zu Win32/Conduit.SearchProtect.H
bluestacks, canon, eset, eset online scanner, malware, meldung, online, rechner, scan, scanner, win, win32/conduit.searchprotect.h




Ähnliche Themen: Win32/Conduit.SearchProtect.H


  1. Windows 8.1 E-Mail-Sicherheitssperre ESET: Win32/Conduit.SearchProtect.I
    Log-Analyse und Auswertung - 22.07.2015 (106)
  2. W.Vista Home basic mit Trojaner TR/Crypt.XPACK.Gen, Conduit/SearchProtect und Brantall infiziert, Probleme mit Avira und möglicherweise EMSI
    Log-Analyse und Auswertung - 21.05.2015 (33)
  3. PUp.Optional.SearchProtect eingefangen
    Log-Analyse und Auswertung - 06.05.2015 (14)
  4. Fehlermeldung xxx.exe - Ungültiges Bild (C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll oder V32Loader.dll)
    Log-Analyse und Auswertung - 18.03.2015 (16)
  5. Windows 7 / SearchProtect/bin/VC64loader.dll
    Plagegeister aller Art und deren Bekämpfung - 17.03.2015 (9)
  6. win7 Trojaner erst gendropper jetzt win32/toolbar. visicom a, conduit, systweak h, your file downloader
    Log-Analyse und Auswertung - 20.11.2014 (15)
  7. win32.Adware.Conduit.B
    Plagegeister aller Art und deren Bekämpfung - 23.10.2014 (13)
  8. Searchprotect auf Windows 8.1
    Plagegeister aller Art und deren Bekämpfung - 14.10.2014 (6)
  9. GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne
    Log-Analyse und Auswertung - 26.09.2014 (17)
  10. Windows 7: PUP.Optional.Conduit.A und PUP.Optional.SearchProtect.A gefunden
    Log-Analyse und Auswertung - 21.03.2014 (7)
  11. PuP.Optional.Searchprotect
    Plagegeister aller Art und deren Bekämpfung - 13.03.2014 (2)
  12. Windows 7: PUP.Optional.SearchProtect.A
    Log-Analyse und Auswertung - 29.11.2013 (11)
  13. Fehlermeldung beim Start "Users\[name]\AppData\Local\Conduit ..." gehabt. Conduit gelöscht aber weiterhin Probleme
    Log-Analyse und Auswertung - 15.11.2013 (9)
  14. Windows 7 64bit - Win32.downloader.gen (C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll) durch Spybot gefunden
    Log-Analyse und Auswertung - 29.09.2013 (7)
  15. Win 7 - Win32.downloader.gen - PUP.Optional.Conduit.A - Befall
    Log-Analyse und Auswertung - 13.09.2013 (7)
  16. Win32.Downloader.gen und Conduit Search: Internet Explorer funktioniert nicht
    Log-Analyse und Auswertung - 11.07.2013 (33)

Zum Thema Win32/Conduit.SearchProtect.H - Hallo ich habe beim Eset online Scanner die Meldung bekomme das ich die obengeannte malware aufm Rechner habe , Kann mir da jemand helfen wie ich die wieder loskriege. Hier - Win32/Conduit.SearchProtect.H...
Archiv
Du betrachtest: Win32/Conduit.SearchProtect.H auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.