| |
| |||||||
Log-Analyse und Auswertung: Proxy-Fehlermeldung 127.0.0.1:8897Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
27.01.2015, 15:33
| #1 |
 |  Proxy-Fehlermeldung 127.0.0.1:8897 Das mit der Software habe ich mir auch gleich gedacht als ich das gesehen habe,  Mache ich alles gleich, ESET läuft noch  ESET Scan Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b479f5e8dc67e24d8157470c23c4d979
# engine=22170
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-27 02:23:49
# local_time=2015-01-27 03:23:49 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 94 20966 106760 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 12990 173998479 0 0
# scanned=245997
# found=0
# cleaned=0
# scan_time=5078
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01 Ran by User (administrator) on USER-PC on 27-01-2015 15:30:04 Running from C:\Users\User\Desktop Loaded Profiles: User (Available profiles: User) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Huawei Technologies Co., Ltd.) C:\Users\User\AppData\Roaming\tele.ring Verbindungsmanager\ouc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard) HKLM-x32\...\Run: [DataCardMonitor] => C:\Program Files (x86)\tele.ring Verbindungsmanager\DataCardMonitor.exe [253952 2013-07-03] (Huawei Technologies Co., Ltd.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Run: [HW_OPENEYE_OUC_tele.ring Verbindungsmanager] => C:\Program Files (x86)\tele.ring Verbindungsmanager\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.) HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: D - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: E - E:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f77-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {29de0f86-227c-11e2-8036-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70504-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {2bf70521-e3b9-11e2-8d2e-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {34c73ff9-2c16-11e2-9a50-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63b6-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {356f63c7-4016-11e1-b766-b1570f61f5d9} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac67-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {5f6fac7e-3f6e-11e1-a137-85ae9d686db3} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {6e38b045-773e-11e1-9b43-e38defa8a60e} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {71060446-88c3-11e2-bd69-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b3d5e5f9-2c6b-11e1-bc7d-806e6f6e6963} - F:\Setup.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49e9-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {b56a49f7-826d-11e2-a311-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c661975b-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {c6619775-e330-11e2-9294-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35ae9-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1 HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {eac35af7-3de2-11e1-a302-90004e63fc55} - D:\.\Autorun.exe AUTORUN=1 HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f660393c-40de-11e1-af44-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {f83e50fe-e95d-11e2-829c-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2493-2277-11e2-bb88-90004e63fc55} - D:\Data\setup.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {facf2499-2277-11e2-bb88-90004e63fc55} - D:\AutoRun.exe HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\MountPoints2: {fb2a7ec3-3411-11e4-a467-90004e63fc55} - D:\AutoRun.exe Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. ProxyServer: [.DEFAULT] => http=127.0.0.1:8897;https=127.0.0.1:8897 HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/?gws_rd=ssl HKU\S-1-5-21-982829961-422532093-1718007052-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/1 SearchScopes: HKLM -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> {E40F8372-A296-4395-92CB-F634CAC151B8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKU\S-1-5-21-982829961-422532093-1718007052-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-08-02] (EasyBits Software Corp.) Tcpip\Parameters: [DhcpNameServer] 10.64.1.224 10.64.1.225 FireFox: ======== FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\gnj2wp5w.default FF Homepage: https://www.google.at FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-03-21] FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-26] FF HKU\S-1-5-21-982829961-422532093-1718007052-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-26] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-26] (AVAST Software) R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed] S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [254016 2014-10-10] (WildTangent) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () S4 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-10-16] (Hewlett-Packard Company) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed] S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] () R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH) S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-26] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-01-26] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-26] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-26] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-26] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-26] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-26] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-26] () R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2009-12-15] (Bytemobile, Inc.) [File not signed] R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-27] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2009-12-15] (Bytemobile, Inc.) [File not signed] S3 cpuz135; \??\C:\Users\User\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X] S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X] S3 zte_ecm_enum_filter; system32\DRIVERS\zte_ecm_enum_filter.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-27 15:30 - 2015-01-27 15:30 - 00017187 _____ () C:\Users\User\Desktop\FRST.txt 2015-01-27 13:55 - 2015-01-27 13:56 - 02347384 _____ (ESET) C:\Users\User\Downloads\esetsmartinstaller_deu.exe 2015-01-27 13:52 - 2015-01-27 15:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl 2015-01-27 13:50 - 2015-01-27 13:51 - 00852573 _____ () C:\Users\User\Desktop\SecurityCheck.exe 2015-01-27 11:26 - 2015-01-27 11:26 - 00000000 ____D () C:\Windows\ERUNT 2015-01-27 11:19 - 2015-01-27 11:22 - 00000000 ____D () C:\AdwCleaner 2015-01-27 11:18 - 2015-01-27 11:19 - 01707939 _____ (Thisisu) C:\Users\User\Desktop\JRT641.exe 2015-01-27 11:17 - 2015-01-27 11:17 - 02194432 _____ () C:\Users\User\Desktop\adwcleaner_4.109.exe 2015-01-27 09:23 - 2015-01-27 15:30 - 00000000 ____D () C:\FRST 2015-01-27 09:23 - 2015-01-27 09:23 - 02129920 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe 2015-01-26 10:48 - 2015-01-26 10:48 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVAST Software 2015-01-26 10:47 - 2015-01-26 10:47 - 00001964 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2015-01-26 10:47 - 2015-01-26 10:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2015-01-26 10:46 - 2015-01-27 15:30 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-01-26 10:46 - 2015-01-26 10:47 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2015-01-26 10:46 - 2015-01-26 10:47 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys 2015-01-26 10:46 - 2015-01-26 10:46 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2015-01-26 10:46 - 2015-01-26 10:46 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2015-01-26 10:46 - 2015-01-26 10:46 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2015-01-26 10:46 - 2015-01-26 10:46 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2015-01-26 10:46 - 2015-01-26 10:46 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2015-01-26 10:46 - 2015-01-26 10:46 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2015-01-26 10:46 - 2015-01-26 10:46 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2015-01-26 10:46 - 2015-01-26 10:46 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2015-01-26 10:45 - 2015-01-26 10:45 - 00000000 ____D () C:\Program Files\AVAST Software 2015-01-26 10:44 - 2015-01-26 10:45 - 00000000 ____D () C:\ProgramData\AVAST Software 2015-01-26 10:40 - 2015-01-26 10:43 - 132469808 _____ (AVAST Software) C:\Users\User\Downloads\avast_free_antivirus_setup.exe 2015-01-26 09:59 - 2015-01-27 15:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-26 09:58 - 2015-01-26 09:58 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-01-26 09:58 - 2015-01-26 09:58 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-01-26 09:58 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-01-26 09:58 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-01-26 09:58 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-01-26 09:56 - 2015-01-26 09:57 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.0.4.1028.exe 2015-01-24 14:18 - 2015-01-24 14:18 - 00000000 ____D () C:\Users\User\Documents\Neuer Ordner (3) 2015-01-23 06:17 - 2015-01-27 15:28 - 00001805 _____ () C:\Windows\setupact.log 2015-01-23 06:17 - 2015-01-27 11:22 - 00016262 _____ () C:\Windows\PFRO.log 2015-01-23 06:17 - 2015-01-23 06:17 - 00000000 _____ () C:\Windows\setuperr.log 2015-01-22 18:19 - 2015-01-27 15:27 - 00357380 _____ () C:\Windows\WindowsUpdate.log 2015-01-19 15:14 - 2015-01-19 15:14 - 00001003 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2015-01-19 15:14 - 2015-01-19 15:14 - 00000991 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk 2015-01-19 15:14 - 2015-01-19 15:14 - 00000000 ____D () C:\Program Files (x86)\TeamViewer 2015-01-19 15:13 - 2015-01-19 15:13 - 07718224 _____ (TeamViewer GmbH) C:\Users\User\Downloads\TeamViewer_Setup_de-ckc.exe 2015-01-14 19:09 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 19:09 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 19:09 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 19:09 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-01-14 19:09 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-01-14 19:09 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-01-14 19:09 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-01-14 19:09 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-01-14 19:09 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-01-14 19:09 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-14 19:09 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-14 19:09 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-01-14 19:09 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp 2015-01-13 16:35 - 2015-01-13 16:35 - 00000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A} 2015-01-01 17:54 - 2015-01-01 17:54 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieBrowserModeList ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-27 15:28 - 2013-03-01 12:20 - 00000420 _____ () C:\Windows\Tasks\Wise Care 365.job 2015-01-27 15:28 - 2012-11-08 10:09 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-27 15:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-27 15:27 - 2012-11-08 10:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-27 15:18 - 2011-12-23 08:48 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DB32AAC0-AE95-47E6-8D2E-C7CA58C9B8C0} 2015-01-27 13:57 - 2010-01-20 11:41 - 11513852 _____ () C:\Windows\system32\perfh007.dat 2015-01-27 13:57 - 2010-01-20 11:41 - 03643192 _____ () C:\Windows\system32\perfc007.dat 2015-01-27 13:57 - 2009-07-14 06:13 - 00006268 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-27 13:43 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-27 13:43 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-27 11:12 - 2012-11-08 10:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-27 10:54 - 2012-03-05 10:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-27 10:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-01-27 10:34 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-26 10:50 - 2012-11-08 09:30 - 00001912 _____ () C:\Windows\epplauncher.mif 2015-01-22 13:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-01-19 17:47 - 2009-07-14 05:45 - 00374152 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-01-19 15:19 - 2011-12-22 08:16 - 00091216 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT 2015-01-14 20:15 - 2013-07-12 17:57 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-14 20:12 - 2011-12-23 10:36 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-08 09:55 - 2011-12-23 08:50 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe ==================== Files in the root of some directories ======= 2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\AtStart.txt 2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 ____H () C:\Users\User\AppData\Local\BIT53EA.tmp 2013-04-07 17:14 - 2013-05-24 17:48 - 0005632 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\DSwitch.txt 2011-12-22 08:15 - 2011-12-22 08:15 - 0000000 _____ () C:\Users\User\AppData\Local\QSwitch.txt 2015-01-13 16:35 - 2015-01-13 16:35 - 0000000 _____ () C:\Users\User\AppData\Local\{4B22D22B-3BA4-40E7-B6BC-98DD75627F4A} 2012-12-30 10:55 - 2015-01-27 15:29 - 0000509 _____ () C:\ProgramData\HPWALog.txt 2012-03-21 15:20 - 2012-03-21 15:40 - 0003039 _____ () C:\ProgramData\hpzinstall.log 2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log 2010-01-20 04:59 - 2010-01-20 04:59 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log 2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log 2010-01-20 04:55 - 2010-01-20 04:56 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log 2010-08-02 13:14 - 2010-08-02 13:14 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log 2010-08-02 13:15 - 2010-08-02 13:15 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log 2010-01-20 04:54 - 2010-01-20 04:55 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log 2010-01-20 04:56 - 2010-01-20 04:58 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log 2010-08-02 13:15 - 2010-08-02 13:15 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\Quarantine.exe C:\Users\User\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-26 13:28 ==================== End Of Log ============================ --- --- --- |
|
27.01.2015, 15:39
| #2 |
| /// TB-Ausbilder   | Proxy-Fehlermeldung 127.0.0.1:8897 Also die Logs sind sauber, der .DEFAULT Proxy ist gut verankert.
__________________Wenn du grad Zeit und Lust hast, würd ich gern 1,2 Sachen testen, bitte: Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter cmd: reg query "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /s
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ |
|
| Themen zu Proxy-Fehlermeldung 127.0.0.1:8897 |
| adware, antivirus, autokms, avira, bingbar, browser, defender, device driver, entfernen, excel, fehler, firefox, flash player, home, homepage, internet, mozilla, onedrive, performance, prozess, realtek, registry, scan, security, services.exe, software, system, vista, windows |
Hybrid-Darstellung
