![]() |
|
Plagegeister aller Art und deren Bekämpfung: Win32/Conduit.SearchProtect.HWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
![]() ![]() | ![]() Win32/Conduit.SearchProtect.H Hallo ich habe beim Eset online Scanner die Meldung bekomme das ich die obengeannte malware aufm Rechner habe , Kann mir da jemand helfen wie ich die wieder loskriege. Hier der Frst Log FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 03 Ran by Florian (administrator) on FLORIAN-PC on 19-01-2015 01:41:42 Running from D:\Installationsprogramme\Antivirensoftware Loaded Profiles: Florian (Available profiles: Florian) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe (TeamViewer GmbH) D:\Programme\TeamViewer\TeamViewer_Service.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe () C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe (Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe () C:\Windows\Samsung\PanelMgr\SSMMgr.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (AVM Berlin) C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe () C:\Windows\Samsung\PanelMgr\caller64.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe (Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\javaw.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_257.exe (Malwarebytes Corporation) D:\Programme\Malwarebytes\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) D:\Programme\Malwarebytes\mbar\mbar\mbar.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-06] (Realtek Semiconductor) HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1609296 2010-06-26] (Logitech, Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-18] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [696320 2011-11-18] () HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe [933888 2012-08-24] (AVM Berlin) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000 Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> D:\Programme\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2977951965-3881512990-2941591932-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> DefaultScope {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2977951965-3881512990-2941591932-1001 -> {5867B61C-0F3F-4E79-BBEB-AC6A84A7813C} URL = hxxp://www.google.de/search?q={searchTerms} BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870 FF Homepage: hxxp://www.t-online.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll () FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1211151.dll No File FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=6.0.12.450 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.448 -> D:\Multimediaprogramme\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> D:\Multimediaprogramme\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\ebay-kleinanzeigen-.xml FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\myvideo.xml FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube-videosuche.xml FF SearchPlugin: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\searchplugins\youtube.xml FF Extension: Avira Browser Safety - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\abs@avira.com [2014-12-12] FF Extension: German Dictionary - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\de-DE@dictionaries.addons.mozilla.org [2014-08-16] FF Extension: DownloadHelper - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06] FF Extension: Add to Search Bar - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\add-to-searchbox@maltekraus.de.xpi [2014-08-16] FF Extension: Classic Theme Restorer - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-08-16] FF Extension: Get Mail Plus [de] - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\getmail@webdesigns.ms11.net.xpi [2014-08-16] FF Extension: Linky - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\linky@gemal.dk.xpi [2014-08-16] FF Extension: Hide Tab Bar With One Tab - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\pzcv1ksp.default-1408203743870\Extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi [2014-08-16] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [nphjeokkkbngjpiofnfpnafjeofjomfb] - C:\Users\Florian\AppData\LocalLow\WOT\CHROME\WOT.crx [2012-01-12] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393032 2013-06-19] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384840 2013-06-19] (BlueStack Systems, Inc.) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed] S3 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [633856 2011-06-08] (Nokia) [File not signed] S3 TDslMgrService; D:\Programme\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) [File not signed] R2 TeamViewer; D:\Programme\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH) S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607040 2010-10-27] (TuneUp Software) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403200 2010-09-30] (TuneUp Software) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WOTUpdater; C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe [18432 2012-01-12] () [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG) S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2012-08-24] (AVM Berlin) S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [30208 2006-11-07] (AVM GmbH) [File not signed] R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [70984 2013-06-19] (BlueStack Systems) R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH) R3 fwlanusb5; C:\Windows\System32\DRIVERS\fwlanusb5.sys [982784 2012-08-24] (AVM GmbH) R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] () S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] () R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [91352 2015-01-19] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-19] (Malwarebytes Corporation) S3 PciDumpr; C:\Program Files (x86)\Common Files\T-Com\DSLCheck\PciDumpr.sys [2144 2001-01-26] () [File not signed] R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-24] (TuneUp Software) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-15 18:39 - 2015-01-15 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2015-01-14 19:16 - 2015-01-14 19:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-14 18:08 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 18:08 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-01-14 18:08 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-01-14 18:08 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-01-14 18:08 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-01-14 18:08 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-01-14 18:08 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-01-14 18:05 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 18:05 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 18:05 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-14 18:05 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-14 18:05 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-01-14 18:05 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-12 22:29 - 2015-01-12 22:30 - 00000000 ____D () C:\Users\Florian\Downloads\Bearbeiten für JHV 2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk 2014-12-28 16:20 - 2014-12-28 16:20 - 00000683 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2014-12-28 15:37 - 2014-12-28 15:37 - 00000669 _____ () C:\Users\Florian\Desktop\teXXas.lnk 2014-12-25 21:34 - 2014-12-25 21:34 - 00000000 ____D () C:\Users\Florian\Documents\eRightSoft 2014-12-22 20:23 - 2014-12-22 20:23 - 00017044 ____N () C:\Users\Florian\Haus Farbenliste.odt 2014-12-20 19:26 - 2014-12-20 19:26 - 00001468 _____ () C:\Users\Public\Desktop\LibreOffice 4.2.lnk 2014-12-20 19:26 - 2014-12-20 19:26 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2 ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-19 01:41 - 2014-08-24 20:37 - 00000000 ____D () C:\FRST 2015-01-19 01:35 - 2014-01-05 23:18 - 00000000 ____D () C:\AdwCleaner 2015-01-19 01:26 - 2014-08-24 21:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-19 01:24 - 2010-05-12 20:21 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{61D97D25-2BEF-4AEC-A94F-510529E28523} 2015-01-19 01:14 - 2012-03-25 12:31 - 00083119 _____ () C:\Users\Florian\Fahrtenbuch.ods 2015-01-19 01:14 - 2010-05-09 12:35 - 00000000 ____D () C:\Users\Florian 2015-01-19 00:57 - 2014-12-14 00:15 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-01-19 00:54 - 2012-12-02 23:26 - 00000000 ____D () C:\Users\Florian\.BH 2015-01-19 00:54 - 2012-07-08 01:26 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-19 00:46 - 2012-08-15 17:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-19 00:18 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-19 00:18 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-19 00:14 - 2014-06-29 17:52 - 01734196 _____ () C:\Windows\WindowsUpdate.log 2015-01-19 00:10 - 2014-10-05 18:31 - 00117602 _____ () C:\Windows\PFRO.log 2015-01-19 00:10 - 2014-10-05 00:00 - 04034561 _____ () C:\Windows\setupact.log 2015-01-19 00:10 - 2012-07-08 01:26 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-19 00:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-18 14:17 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Verzeichnisse 2015-01-18 02:43 - 2014-08-17 14:14 - 00000000 ____D () C:\Users\Florian\dwhelper 2015-01-17 21:07 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\Internet 2015-01-17 19:28 - 2010-12-19 00:56 - 00000000 __SHD () C:\Users\Florian\wc 2015-01-17 16:49 - 2014-01-06 03:24 - 00181248 _____ () C:\Users\Florian\Einausgaben.xls 2015-01-17 00:05 - 2013-09-30 20:39 - 00095232 _____ () C:\Users\Florian\Arbeitszeitnachweis.xls 2015-01-16 23:29 - 2011-12-20 19:18 - 00000099 _____ () C:\Users\Public\LMDebug.log 2015-01-15 23:14 - 2012-10-31 19:42 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc 2015-01-15 22:31 - 2012-05-05 15:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-15 20:36 - 2009-07-14 18:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat 2015-01-15 20:36 - 2009-07-14 18:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat 2015-01-15 20:36 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-15 20:35 - 2014-10-29 19:53 - 00000000 ____D () C:\Users\Florian\Freundeskreis 2015-01-15 20:30 - 2010-05-13 23:41 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\VSO 2015-01-15 20:09 - 2012-08-15 17:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-15 20:09 - 2012-03-30 13:31 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-15 20:09 - 2012-01-14 19:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-15 20:09 - 2010-05-13 16:52 - 01025024 ___SH () C:\Users\Florian\Thumbs.db 2015-01-14 19:58 - 2013-07-18 14:49 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-14 19:54 - 2010-05-13 14:03 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-14 19:23 - 2010-05-13 20:38 - 00077981 _____ () C:\Windows\cdplayer.ini 2015-01-13 19:02 - 2014-01-06 02:51 - 00028851 _____ () C:\Users\Florian\Haus Zählerstände Haus.ods 2015-01-11 16:31 - 2012-09-09 16:34 - 00000000 ____D () C:\Users\Florian\AppData\Local\CrashDumps 2015-01-10 18:24 - 2014-06-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom 2015-01-10 18:24 - 2010-05-13 14:13 - 00000000 ____D () C:\Program Files (x86)\TomTom HOME 2 2015-01-10 18:23 - 2010-07-08 13:11 - 00000000 ____D () C:\Users\Florian\AppData\Local\Downloaded Installations 2015-01-10 15:24 - 2010-05-13 21:57 - 00000000 ____D () C:\ProgramData\DVD Shrink 2015-01-07 00:35 - 2011-06-09 20:07 - 00000000 ____D () C:\ProgramData\tmp 2015-01-07 00:23 - 2010-05-10 18:41 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs 2015-01-05 15:46 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-01-03 01:13 - 2010-05-14 13:52 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Winamp 2015-01-03 01:13 - 2010-05-10 18:14 - 00000000 ____D () C:\ProgramData\CanonIJ 2015-01-03 01:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2015-01-02 01:16 - 2010-05-14 12:57 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Media Player Classic 2014-12-28 17:56 - 2009-07-14 05:45 - 00673912 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-28 16:54 - 2014-08-12 23:56 - 00121688 _____ () C:\Users\Florian\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-26 02:16 - 2010-06-06 18:20 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-12-25 22:52 - 2014-07-26 17:40 - 00000691 _____ () C:\Users\Public\Desktop\dm-Fotowelt.lnk 2014-12-22 20:53 - 2012-12-02 14:32 - 00040645 ____N () C:\Users\Florian\Kalender.ods 2014-12-22 20:51 - 2012-11-01 22:12 - 00112898 ____N () C:\Users\Florian\geburtstagskalender.ods 2014-12-22 20:47 - 2012-03-25 12:34 - 00000000 ____D () C:\Users\Florian\cover 2014-12-20 20:23 - 2010-11-07 22:34 - 00000673 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-12-20 19:26 - 2014-02-17 21:19 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4 ==================== Files in the root of some directories ======= 2010-05-28 18:58 - 2013-05-12 21:00 - 0000192 _____ () C:\Users\Florian\AppData\Roaming\default.rss 2010-05-28 18:58 - 2010-05-28 18:58 - 0000000 _____ () C:\Users\Florian\AppData\Roaming\downloads.m3u 2014-08-17 11:56 - 2014-11-28 18:57 - 0015360 _____ () C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2010-07-02 21:31 - 2010-07-02 21:32 - 0000333 _____ () C:\ProgramData\hpzinstall.log Some content of TEMP: ==================== C:\Users\Florian\AppData\Local\Temp\avgnt.exe C:\Users\Florian\AppData\Local\Temp\RegSvr32User.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-14 18:17 ==================== End Of Log ============================ --- --- --- --- --- --- hier noch der GMER file Code:
ATTFilter MER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-01-19 04:06:46 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000062 Hitachi_ rev.ST6O 931,51GB Running: Gmer-19357.exe; Driver: C:\Users\Florian\AppData\Local\Temp\pwdiyfob.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448 fffff800033b0000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495 fffff800033b002f 23 bytes [00, 00, 00, 00, 00, 00, 00, ...] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076571401 2 bytes JMP 7725b21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076571419 2 bytes JMP 7725b346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076571431 2 bytes JMP 772d8ea9 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007657144a 2 bytes CALL 772348ad C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000765714dd 2 bytes JMP 772d87a2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000765714f5 2 bytes JMP 772d8978 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007657150d 2 bytes JMP 772d8698 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076571525 2 bytes JMP 772d8a62 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007657153d 2 bytes JMP 7724fca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076571555 2 bytes JMP 772568ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007657156d 2 bytes JMP 772d8f61 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076571585 2 bytes JMP 772d8ac2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007657159d 2 bytes JMP 772d865c C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000765715b5 2 bytes JMP 7724fd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000765715cd 2 bytes JMP 7725b2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000765716b2 2 bytes JMP 772d8e24 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\BlueStacks\HD-Agent.exe[2080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000765716bd 2 bytes JMP 772d85f1 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076571401 2 bytes JMP 7725b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076571419 2 bytes JMP 7725b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076571431 2 bytes JMP 772d8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007657144a 2 bytes CALL 772348ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000765714dd 2 bytes JMP 772d87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000765714f5 2 bytes JMP 772d8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007657150d 2 bytes JMP 772d8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076571525 2 bytes JMP 772d8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007657153d 2 bytes JMP 7724fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076571555 2 bytes JMP 772568ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007657156d 2 bytes JMP 772d8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076571585 2 bytes JMP 772d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007657159d 2 bytes JMP 772d865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000765715b5 2 bytes JMP 7724fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000765715cd 2 bytes JMP 7725b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000765716b2 2 bytes JMP 772d8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Java\jre7\bin\javaw.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000765716bd 2 bytes JMP 772d85f1 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Process C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe (*** suspicious ***) @ C:\Users\Florian\AppData\LocalLow\WOT\IE\WOTUpdater.exe [2492](2012-01-12 10:23:20) 0000000000120000 ---- Registry - GMER 2.1 ---- Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Florian\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe 1 ---- EOF - GMER 2.1 ---- Malwarebyte gibt die meldung das es an der Datei CltMngSVC.exe liegt Geändert von schaule (19.01.2015 um 04:53 Uhr) |
Themen zu Win32/Conduit.SearchProtect.H |
bluestacks, canon, eset, eset online scanner, malware, meldung, online, rechner, scan, scanner, win, win32/conduit.searchprotect.h |