| |
| |||||||
Log-Analyse und Auswertung: Windows7, Fehlermeldung von Avast: Rootkit gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
02.02.2015, 12:24
| #1 |
| /// the machine /// TB-Ausbilder    |  Windows7, Fehlermeldung von Avast: Rootkit gefunden Avast Fehlalarm. Lass ESET weg, mach dafür das hier: Lade Dir bitte von hier  Emsisoft Emergency Kit herunter.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.02.2015, 22:31
| #2 |
 | Windows7, Fehlermeldung von Avast: Rootkit gefunden Hallo Schrauber,
__________________jetzt lief alles ohne Probleme. Anbei alle Logs. Code:
ATTFilter Emsisoft Emergency Kit - Version 9.0
Letztes Update: 02.02.2015 20:44:36
Benutzerkonto: Kathrin-PC\Kathrin
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, Q:\
PUPs-Erkennung: An
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus
Scan Beginn: 02.02.2015 20:52:06
Value: HKEY_USERS\S-1-5-21-929969998-3954605437-2991725684-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR gefunden: Setting.DisableTaskMgr (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS gefunden: Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-929969998-3954605437-2991725684-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS gefunden: Setting.DisableRegistryTools (A)
Gescannt 242815
Gefunden 3
Scan Ende: 02.02.2015 22:08:41
Scan Zeit: 1:16:35
Value: HKEY_USERS\S-1-5-21-929969998-3954605437-2991725684-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Quarantäne Setting.DisableRegistryTools (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Quarantäne Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-929969998-3954605437-2991725684-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR Quarantäne Setting.DisableTaskMgr (A)
Quarantäne 3
Code:
ATTFilter Results of screen317's Security Check version 0.99.95
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Secunia PSI (3.0.0.7011)
Java 7 Update 51
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Adobe Flash Player 16.0.0.296
Adobe Reader 10.1.2 Adobe Reader out of Date!
Mozilla Firefox (35.0.1)
Mozilla Thunderbird 24.6.0 Thunderbird out of Date!
Google Chrome (40.0.2214.91)
Google Chrome (40.0.2214.93)
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast ng vbox\AvastVBoxSVC.exe
AVAST Software Avast ng ngservice.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Kathrin (administrator) on KATHRIN-PC on 02-02-2015 22:17:03
Running from C:\Users\Kathrin\Downloads
Loaded Profiles: Kathrin (Available profiles: Kathrin)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() C:\Program Files (x86)\PHotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
() C:\Program Files (x86)\watchmi\TvdTray.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
(Emsisoft GmbH) C:\EEK\bin\a2emergencykit.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
() C:\Users\Kathrin\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-01-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2884880 2012-02-23] (Synaptics Incorporated)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink Corp.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-23] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-929969998-3954605437-2991725684-1000\...\Run: [HP Deskjet 3050A J611 series (NET)] => C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe [2676584 2011-06-08] (Hewlett-Packard Co.)
HKU\S-1-5-21-929969998-3954605437-2991725684-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk
ShortcutTarget: watchmi tray.lnk -> C:\Windows\Installer\{F0559C5E-7912-4391-B1A0-6B975F0E5064}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe (Acresso Software Inc.)
Startup: C:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3050A J611 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3050A J611 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-929969998-3954605437-2991725684-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-929969998-3954605437-2991725684-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-929969998-3954605437-2991725684-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-929969998-3954605437-2991725684-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\z12dg29e.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\z12dg29e.default\Extensions\artur.dubovoy@gmail.com [2015-01-27]
FF Extension: DownloadHelper - C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\z12dg29e.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-09]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2015-01-28]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2015-01-28]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-07-17]
Chrome:
=======
CHR HomePage: Default -> https://de.yahoo.com?fr=hp-avast&type=avastbcl
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> golsearch.com
CHR DefaultSearchURL: Default -> hxxp://www.golsearch.com/?q={searchTerms}&babsrc=SP_ss_Btisdt6&mntrId=8CC9685D430494AE&affID=119357&tsp=5007
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U2) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Profile: C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-07]
CHR Extension: (WEB.DE MailCheck) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jaogepninmlbinccpbiakcgiolijlllo [2014-07-19]
CHR Extension: (Google Wallet) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-29]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-22]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-22] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-01-22] (Avast Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S4 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 A2DDA; C:\EEK\BIN\a2ddax64.sys [26176 2015-02-02] (Emsisoft GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-22] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-22] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-22] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-22] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-22] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-22] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-22] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-22] ()
R3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-02-02] (Emsisoft GmbH)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-01-27] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-01] (Malwarebytes Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-01-22] (Avast Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-02 22:12 - 2015-02-02 22:12 - 00852573 _____ () C:\Users\Kathrin\Downloads\SecurityCheck.exe
2015-02-02 20:42 - 2015-02-02 20:42 - 00000747 _____ () C:\Users\Kathrin\Desktop\Start Emsisoft Emergency Kit.lnk
2015-02-02 20:42 - 2015-02-02 20:42 - 00000000 ____D () C:\EEK
2015-02-02 20:38 - 2015-02-02 20:41 - 170235400 _____ () C:\Users\Kathrin\Downloads\EmsisoftEmergencyKit (1).exe
2015-02-02 20:29 - 2015-02-02 20:29 - 00000197 _____ () C:\Windows\system32\2015-02-02-19-29-10.096-AvastVBoxSVC.exe-3480.log
2015-02-01 21:55 - 2015-02-01 21:55 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-01 21:54 - 2015-02-01 21:55 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_deu.exe
2015-02-01 21:48 - 2015-02-01 21:48 - 00000197 _____ () C:\Windows\system32\2015-02-01-20-48-40.026-AvastVBoxSVC.exe-5552.log
2015-02-01 12:49 - 2015-02-01 12:49 - 00000197 _____ () C:\Windows\system32\2015-02-01-11-49-39.077-AvastVBoxSVC.exe-4120.log
2015-02-01 11:58 - 2015-02-01 11:58 - 00000000 ____D () C:\Users\Kathrin\Downloads\FRST-OlderVersion
2015-02-01 11:57 - 2015-02-01 11:57 - 00003706 _____ () C:\Users\Kathrin\Desktop\JRT.txt
2015-02-01 11:52 - 2015-02-01 11:52 - 01707939 _____ (Thisisu) C:\Users\Kathrin\Downloads\JRT.exe
2015-02-01 11:52 - 2015-02-01 11:52 - 00000000 ____D () C:\Windows\ERUNT
2015-02-01 11:32 - 2015-02-01 11:32 - 00000197 _____ () C:\Windows\system32\2015-02-01-10-32-23.079-AvastVBoxSVC.exe-4840.log
2015-02-01 11:18 - 2015-02-01 11:26 - 00000000 ____D () C:\AdwCleaner
2015-02-01 11:15 - 2015-02-01 11:15 - 02194432 _____ () C:\Users\Kathrin\Downloads\AdwCleaner_4.109.exe
2015-02-01 11:11 - 2015-02-01 11:11 - 00001202 _____ () C:\Users\Kathrin\Desktop\mbam.txt
2015-02-01 10:30 - 2015-02-01 10:30 - 00000197 _____ () C:\Windows\system32\2015-02-01-09-30-39.081-AvastVBoxSVC.exe-3320.log
2015-01-31 20:40 - 2015-01-31 20:40 - 00030952 _____ () C:\ComboFix.txt
2015-01-31 20:28 - 2015-01-31 20:40 - 00000000 ____D () C:\Qoobox
2015-01-31 20:28 - 2015-01-31 20:40 - 00000000 ____D () C:\ComboFix
2015-01-31 20:28 - 2015-01-31 20:39 - 00000000 ____D () C:\Windows\erdnt
2015-01-31 20:28 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-31 20:28 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-31 20:28 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-31 20:28 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-31 20:28 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-31 20:28 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-31 20:28 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-31 20:28 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-31 20:24 - 2015-01-31 20:24 - 05611408 ____R (Swearware) C:\Users\Kathrin\Downloads\ComboFix.exe
2015-01-31 20:13 - 2015-01-31 20:13 - 00000197 _____ () C:\Windows\system32\2015-01-31-19-13-15.043-AvastVBoxSVC.exe-3680.log
2015-01-31 15:23 - 2015-01-31 15:23 - 00000197 _____ () C:\Windows\system32\2015-01-31-14-23-31.063-AvastVBoxSVC.exe-4712.log
2015-01-31 14:09 - 2015-01-31 14:09 - 00000197 _____ () C:\Windows\system32\2015-01-31-13-09-10.064-AvastVBoxSVC.exe-3740.log
2015-01-31 14:05 - 2015-01-31 14:05 - 764707208 _____ () C:\Windows\MEMORY.DMP
2015-01-31 14:05 - 2015-01-31 14:05 - 00285160 _____ () C:\Windows\Minidump\013115-26754-01.dmp
2015-01-31 13:50 - 2015-01-31 13:50 - 00006719 _____ () C:\Gmer.txt
2015-01-31 13:35 - 2015-01-31 13:35 - 00380416 _____ () C:\Users\Kathrin\Downloads\Gmer-19357.exe
2015-01-31 13:27 - 2015-01-31 13:28 - 00050736 _____ () C:\Users\Kathrin\Downloads\Addition.txt
2015-01-31 13:26 - 2015-02-02 22:17 - 00023335 _____ () C:\Users\Kathrin\Downloads\FRST.txt
2015-01-31 13:25 - 2015-01-31 13:25 - 00000197 _____ () C:\Windows\system32\2015-01-31-12-25-20.067-AvastVBoxSVC.exe-5836.log
2015-01-31 13:14 - 2015-02-02 22:17 - 00000000 ____D () C:\FRST
2015-01-31 13:11 - 2015-02-01 11:58 - 02131456 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64.exe
2015-01-31 13:02 - 2015-01-31 14:12 - 00000476 _____ () C:\Windows\SysWOW64\defogger_disable.log
2015-01-31 13:02 - 2015-01-31 13:02 - 00000000 _____ () C:\Users\Kathrin\defogger_reenable
2015-01-31 13:01 - 2015-01-31 13:01 - 00050477 _____ () C:\Users\Kathrin\Downloads\Defogger.exe
2015-01-31 12:23 - 2015-01-31 12:23 - 00000197 _____ () C:\Windows\system32\2015-01-31-11-23-37.048-AvastVBoxSVC.exe-3320.log
2015-01-29 18:40 - 2015-01-29 18:40 - 00000197 _____ () C:\Windows\system32\2015-01-29-17-40-03.080-AvastVBoxSVC.exe-5196.log
2015-01-29 15:43 - 2015-01-29 15:43 - 00000197 _____ () C:\Windows\system32\2015-01-29-14-43-18.034-AvastVBoxSVC.exe-2628.log
2015-01-29 07:13 - 2015-01-29 07:13 - 00000197 _____ () C:\Windows\system32\2015-01-29-06-13-22.016-AvastVBoxSVC.exe-5384.log
2015-01-28 20:44 - 2015-01-28 20:45 - 00000197 _____ () C:\Windows\system32\2015-01-28-19-44-59.002-AvastVBoxSVC.exe-1440.log
2015-01-28 20:41 - 2015-02-02 20:26 - 00000784 _____ () C:\Windows\setupact.log
2015-01-28 20:41 - 2015-02-01 11:29 - 00002478 _____ () C:\Windows\PFRO.log
2015-01-28 20:41 - 2015-01-28 20:41 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-28 20:36 - 2015-01-28 20:36 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-01-28 20:36 - 2015-01-28 20:36 - 00000786 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-28 20:36 - 2015-01-28 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-28 20:36 - 2015-01-28 20:36 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-28 20:35 - 2015-01-28 20:35 - 05325208 _____ (Piriform Ltd) C:\Users\Kathrin\Downloads\ccsetup502.exe
2015-01-28 20:14 - 2015-02-01 10:48 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-28 20:14 - 2015-01-28 20:14 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-28 20:14 - 2015-01-28 20:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-28 20:14 - 2015-01-28 20:14 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-28 20:14 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-28 20:14 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-28 20:14 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-28 20:13 - 2015-01-28 20:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-28 19:29 - 2015-01-28 19:29 - 00001268 _____ () C:\Users\Kathrin\Desktop\Revo Uninstaller.lnk
2015-01-28 19:29 - 2015-01-28 19:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-28 19:22 - 2015-01-28 19:22 - 00000197 _____ () C:\Windows\system32\2015-01-28-18-22-34.098-AvastVBoxSVC.exe-6132.log
2015-01-28 09:47 - 2015-01-28 09:47 - 00000197 _____ () C:\Windows\system32\2015-01-28-08-47-20.068-AvastVBoxSVC.exe-5816.log
2015-01-28 07:13 - 2015-01-28 07:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 07:00 - 2015-01-28 07:01 - 00000197 _____ () C:\Windows\system32\2015-01-28-06-00-49.012-AvastVBoxSVC.exe-4980.log
2015-01-27 19:10 - 2015-01-27 19:10 - 00003338 _____ () C:\Windows\System32\Tasks\SpyHunter4Startup
2015-01-27 19:10 - 2015-01-27 19:10 - 00000000 ____D () C:\sh4ldr
2015-01-27 19:10 - 2015-01-27 19:10 - 00000000 _____ () C:\autoexec.bat
2015-01-27 19:09 - 2015-01-28 20:41 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-01-27 19:09 - 2015-01-27 19:09 - 00022704 _____ () C:\Windows\system32\Drivers\EsgScanner.sys
2015-01-27 18:43 - 2015-01-27 18:43 - 00000197 _____ () C:\Windows\system32\2015-01-27-17-43-35.036-AvastVBoxSVC.exe-2716.log
2015-01-27 18:18 - 2015-01-27 18:18 - 00000197 _____ () C:\Windows\system32\2015-01-27-17-18-13.039-AvastVBoxSVC.exe-4684.log
2015-01-27 18:09 - 2015-01-27 18:09 - 00000197 _____ () C:\Windows\system32\2015-01-27-17-09-58.075-AvastVBoxSVC.exe-5888.log
2015-01-27 16:34 - 2015-01-27 16:34 - 00000197 _____ () C:\Windows\system32\2015-01-27-15-34-13.040-AvastVBoxSVC.exe-4108.log
2015-01-26 14:48 - 2015-01-26 14:48 - 00000197 _____ () C:\Windows\system32\2015-01-26-13-48-28.015-AvastVBoxSVC.exe-5236.log
2015-01-26 13:03 - 2015-01-26 13:04 - 00000197 _____ () C:\Windows\system32\2015-01-26-12-03-58.033-AvastVBoxSVC.exe-5800.log
2015-01-25 22:21 - 2015-01-25 22:21 - 00000197 _____ () C:\Windows\system32\2015-01-25-21-21-18.040-AvastVBoxSVC.exe-3352.log
2015-01-25 09:30 - 2015-01-25 09:30 - 00000247 _____ () C:\Windows\system32\2015-01-25-08-30-14.072-aswFe.exe-8120.log
2015-01-25 09:24 - 2015-01-25 09:30 - 00000247 _____ () C:\Windows\system32\2015-01-25-08-24-34.066-aswFe.exe-7540.log
2015-01-25 09:24 - 2015-01-25 09:24 - 00000197 _____ () C:\Windows\system32\2015-01-25-08-24-30.068-AvastVBoxSVC.exe-4716.log
2015-01-24 22:18 - 2015-01-24 22:18 - 00000197 _____ () C:\Windows\system32\2015-01-24-21-18-34.084-AvastVBoxSVC.exe-3780.log
2015-01-24 08:32 - 2015-01-24 08:32 - 00000197 _____ () C:\Windows\system32\2015-01-24-07-32-46.067-AvastVBoxSVC.exe-4160.log
2015-01-23 22:28 - 2015-01-23 22:28 - 00000197 _____ () C:\Windows\system32\2015-01-23-21-28-46.041-AvastVBoxSVC.exe-4816.log
2015-01-23 08:18 - 2015-01-23 08:18 - 00000197 _____ () C:\Windows\system32\2015-01-23-07-18-06.057-AvastVBoxSVC.exe-5212.log
2015-01-22 15:05 - 2015-01-22 15:05 - 01718176 _____ (Netviewer GmbH) C:\Users\Kathrin\Downloads\NV_Support_Teilnehmer.exe
2015-01-22 11:51 - 2015-01-22 11:51 - 00000247 _____ () C:\Windows\system32\2015-01-22-10-51-14.080-aswFe.exe-6960.log
2015-01-22 11:45 - 2015-01-22 11:51 - 00000247 _____ () C:\Windows\system32\2015-01-22-10-45-18.051-aswFe.exe-7832.log
2015-01-22 11:45 - 2015-01-22 11:45 - 00000197 _____ () C:\Windows\system32\2015-01-22-10-45-14.056-AvastVBoxSVC.exe-4280.log
2015-01-22 11:20 - 2015-01-22 11:25 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-01-22 11:20 - 2015-01-22 11:25 - 00000000 ____D () C:\Windows\system32\vbox
2015-01-22 11:09 - 2015-01-22 11:09 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-22 11:09 - 2015-01-22 11:09 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-22 11:09 - 2015-01-22 11:09 - 00001928 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-01-15 07:42 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 10:25 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 10:25 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 10:25 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 10:25 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 10:25 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 10:25 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 10:25 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 10:25 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 10:25 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 10:25 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 10:25 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 10:25 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-02 22:01 - 2013-11-11 15:33 - 00000260 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2015-02-02 21:46 - 2012-05-13 15:34 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-02 21:41 - 2013-03-19 16:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-02 20:41 - 2009-07-14 05:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-02 20:41 - 2009-07-14 05:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-02 20:39 - 2012-05-14 01:30 - 02043425 _____ () C:\Windows\WindowsUpdate.log
2015-02-02 20:38 - 2012-05-13 15:43 - 00000000 ____D () C:\Users\Kathrin\Documents\Youcam
2015-02-02 20:28 - 2014-07-17 09:58 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-02 20:28 - 2012-05-13 15:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-02 20:26 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-31 20:37 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-31 20:36 - 2012-05-13 15:40 - 00000000 ____D () C:\Users\Kathrin
2015-01-31 14:05 - 2013-08-10 05:36 - 00000000 ____D () C:\Windows\Minidump
2015-01-28 20:40 - 2012-02-21 19:26 - 00000000 ____D () C:\Windows\Panther
2015-01-28 09:43 - 2012-08-04 10:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 17:19 - 2014-07-15 16:24 - 00000000 ____D () C:\Users\Kathrin\AppData\Roaming\Dropbox
2015-01-27 16:47 - 2012-05-13 15:34 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-26 13:10 - 2012-02-21 19:50 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2015-01-26 13:10 - 2012-02-21 19:50 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2015-01-26 13:10 - 2009-07-14 06:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-25 10:41 - 2013-03-19 16:43 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 10:41 - 2013-03-19 16:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 10:41 - 2012-02-21 22:31 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-22 11:09 - 2014-07-17 09:57 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-22 11:09 - 2014-07-17 09:57 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2015-01-22 11:09 - 2014-07-17 09:57 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-22 11:09 - 2014-07-17 09:57 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-01-22 11:09 - 2014-07-17 09:57 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-22 11:09 - 2014-07-17 09:57 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-01-22 11:09 - 2014-07-17 09:57 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-22 11:09 - 2014-07-17 09:57 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-14 12:54 - 2013-08-16 13:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 12:48 - 2012-02-21 20:44 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2013-09-16 17:50 - 2013-11-07 07:54 - 0000094 _____ () C:\Users\Kathrin\AppData\Roaming\WB.CFG
2013-09-16 17:50 - 2013-11-07 07:54 - 0000006 _____ () C:\Users\Kathrin\AppData\Roaming\WBPU-TTL.DAT
2012-05-25 18:18 - 2012-05-25 18:18 - 0017408 _____ () C:\Users\Kathrin\AppData\Local\WebpageIcons.db
2013-11-11 15:31 - 2013-11-11 15:31 - 0000057 _____ () C:\ProgramData\Ament.ini
Some content of TEMP:
====================
C:\Users\Kathrin\AppData\Local\Temp\Quarantine.exe
C:\Users\Kathrin\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-26 17:08
==================== End Of Log ============================
--- --- --- avast hat mir heute zwar wieder die Warnungen gegeben, die ich dir gestern schon geschrieben habe. Aber die Warnung das ein Rootkit gefunden wurde erscheint nicht mehr. Viele Grüße  sk_muecke |
|
| Themen zu Windows7, Fehlermeldung von Avast: Rootkit gefunden |
| antivirus, bingbar, browser, ccsetup, computer, device driver, downloader, entfernen, esgscanner.sys, firefox, flash player, helper, home, homepage, internet, internet explorer, kaspersky, object, popup, programm, revo uninstaller, rootkit, security, server, software, svchost.exe, system, usb, virus, windows |
Hybrid-Darstellung
