|
Log-Analyse und Auswertung: Windows 7: Adware EoRezo kommt täglichWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
22.07.2015, 08:39 | #16 |
| Windows 7: Adware EoRezo kommt täglich Hallo Schrauber, anbei die Logs. Das habe ich übersehen. Danke knisbits FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-07-2015 Ran by ***** (administrator) on DELL on 22-07-2015 09:31:08 Running from C:\Users\*****\Desktop\trojanerboard\programme Loaded Profiles: ***** & Gast & (Available Profiles: ***** & Gast) Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) () C:\Windows\System32\WLTRYSVC.EXE (Dell Inc.) C:\Windows\System32\BCMWLTRY.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe () C:\ProgramData\MobileBrServ\mbbService.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avmailc7.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe (CANON INC.) C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avgnt.exe (Neuber Software - www.neuber.com) C:\Program Files\Security Task Manager\SpyProtector.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Antivirus\avwebg7.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe (Adobe Systems Incorporated) C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Dropbox, Inc.) C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [249856 2009-06-19] (Alps Electric Co., Ltd.) HKLM\...\Run: [IJNetworkScanUtility] => C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [128352 2010-01-18] (CANON INC.) HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-04] (CANON INC.) HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH) HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\Antivirus\avgnt.exe [730416 2015-06-16] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Speedup_umh] => C:\Program Files\Avira\AviraSpeedup\Speedup_umh.exe [194832 2015-06-17] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\Run: [Spy Protector] => C:\Program Files\Security Task Manager\SpyProtector.exe [143696 2015-01-20] (Neuber Software - www.neuber.com) HKU\S-1-5-21-2658783408-2872151984-4163876688-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spy Protector] => C:\Program Files\Security Task Manager\SpyProtector.exe [143696 2015-01-20] (Neuber Software - www.neuber.com) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-26] (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/de-de/?ocid=U218DHP&pc=U218 HKU\S-1-5-21-2658783408-2872151984-4163876688-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2658783408-2872151984-4163876688-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/de-de/?ocid=U218DHP&pc=U218 HKU\S-1-5-21-2658783408-2872151984-4163876688-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKU\S-1-5-21-2658783408-2872151984-4163876688-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKU\S-1-5-21-2658783408-2872151984-4163876688-501\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/ HKU\S-1-5-21-2658783408-2872151984-4163876688-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation) BHO: AviraBrowserSafety.BrowserSafety -> {c3c77255-42c0-499f-b664-6e981a0b1647} -> C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{40291A9A-F343-4464-AE17-E07FD7983EC2}: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{83642F9C-5316-4FBD-86F3-C5568057A4A7}: [DhcpNameServer] 192.168.8.1 192.168.8.1 Tcpip\..\Interfaces\{D1A00C5C-B00A-41C1-BC16-B4F2AB0BA1F4}: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\jdbxjma1.default FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml FF SearchEngineOrder.1: Ask Search FF Homepage: hxxp://web.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_210.dll [2015-07-17] () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] () FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-27] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-27] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\jdbxjma1.default\Extensions\abs@avira.com [2015-07-21] FF Extension: WEB.DE MailCheck - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\jdbxjma1.default\Extensions\mailcheck@web.de [2015-05-27] FF Extension: Adblock Plus Pop-up Addon - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\jdbxjma1.default\Extensions\adblockpopups@jessehakanen.net.xpi [2015-06-19] FF Extension: Browser-Security - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\jdbxjma1.default\Extensions\firefox@browser-security.de.xpi [2015-05-27] FF Extension: Forecastfox (fix version) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\jdbxjma1.default\Extensions\forecastfox@s3_fix_version.xpi [2015-05-11] FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\jdbxjma1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-15] Chrome: ======= CHR HKLM\...\Chrome\Extension: [fgibjgmnimooanbagcfpnkmngejcojaf] - No Path Or update_url value CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AdobeActiveFileMonitor10.0; C:\Program Files\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated) R2 AntiVirMailService; C:\Program Files\Avira\Antivirus\avmailc7.exe [827184 2015-06-16] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files\Avira\Antivirus\sched.exe [450808 2015-06-16] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\Antivirus\avguard.exe [450808 2015-06-16] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\Antivirus\avwebg7.exe [1188360 2015-06-16] (Avira Operations GmbH & Co. KG) R2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R4 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239696 2013-07-23] () R2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [202544 2008-03-11] (SupportSoft, Inc.) S3 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [234096 2013-07-24] (soft Xpansion) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation) R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2809856 2008-11-17] (Dell Inc.) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108448 2015-06-16] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136728 2015-06-16] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-06-16] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-06-16] (Avira Operations GmbH & Co. KG) R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-11-17] (Broadcom Corporation) R3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [54784 2008-08-25] (ITE Tech. Inc. ) S3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbus.sys [10496 2009-09-29] (LG Electronics Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [98520 2015-07-21] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-16] (Avira Operations GmbH & Co. KG) S3 AndNetDiag; system32\DRIVERS\lgandnetdiag.sys [X] S3 ANDNetModem; system32\DRIVERS\lgandnetmodem.sys [X] U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchme.sys [X] S3 eapihdrv; \??\C:\Users\*****\AppData\Local\Temp\ehdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-21 10:02 - 2015-07-21 14:32 - 00000112 _____ C:\Windows\setupact.log 2015-07-21 09:59 - 2015-07-21 09:59 - 00001094 _____ C:\Users\Public\Desktop\Avira System Speedup.lnk 2015-07-18 19:40 - 2015-07-18 19:40 - 02248704 _____ C:\Users\*****\Desktop\AdwCleaner_4.208.exe 2015-07-14 20:46 - 2015-07-14 21:09 - 00000000 ____D C:\Qoobox 2015-07-14 20:46 - 2015-07-14 21:09 - 00000000 ____D C:\ComboFix 2015-07-14 20:46 - 2015-07-14 21:07 - 00000000 ____D C:\Windows\erdnt 2015-07-14 20:46 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe 2015-07-14 20:46 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe 2015-07-14 20:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-07-14 20:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-07-14 20:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-07-14 20:46 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe 2015-07-14 20:46 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe 2015-07-14 20:46 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe 2015-07-14 14:06 - 2015-07-14 14:06 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-07-09 20:23 - 2015-07-22 09:31 - 00000000 ____D C:\FRST 2015-07-09 20:21 - 2015-07-09 20:21 - 00000000 _____ C:\Users\*****\defogger_reenable 2015-07-09 20:13 - 2015-07-20 11:33 - 00000000 ____D C:\Users\*****\Desktop\trojanerboard 2015-07-09 12:23 - 2015-07-21 09:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup 2015-07-09 12:23 - 2015-07-09 15:18 - 00000000 ____D C:\Users\*****\AppData\Local\AviraSpeedup 2015-07-09 12:20 - 2015-07-09 12:21 - 00000000 ____D C:\Users\Public\Speedup Sessions 2015-07-07 11:44 - 2015-07-07 11:44 - 00000000 ____D C:\Users\*****\AppData\Roaming\Avira 2015-07-07 11:43 - 2015-07-07 12:09 - 00002011 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk 2015-07-07 11:41 - 2015-06-16 09:36 - 00136728 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-07-07 11:41 - 2015-06-16 09:36 - 00108448 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-07-07 11:41 - 2015-06-16 09:36 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-07-07 11:41 - 2015-06-16 09:36 - 00037896 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2015-07-07 10:40 - 2015-07-07 10:40 - 00000000 ____D C:\Users\*****\Mozilla 2015-06-29 09:38 - 2015-07-21 14:32 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-06-29 09:38 - 2015-07-02 09:33 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-06-29 09:38 - 2015-07-02 09:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-06-29 09:38 - 2015-06-18 09:38 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-06-29 09:38 - 2015-06-18 09:38 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-06-29 09:38 - 2015-06-18 09:38 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-06-25 11:33 - 2015-07-14 21:29 - 00000000 ____D C:\ProgramData\TEMP 2015-06-25 11:33 - 2015-07-14 21:25 - 00000000 ____D C:\Program Files\SpywareBlaster 2015-06-25 11:33 - 2015-06-25 11:33 - 00001048 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk 2015-06-25 11:33 - 2015-06-25 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster 2015-06-25 11:33 - 2015-06-25 11:33 - 00000000 ____D C:\ProgramData\Licenses 2015-06-25 11:33 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\Windows\system32\MSSTDFMT.DLL 2015-06-23 21:05 - 2015-01-09 04:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-06-23 21:05 - 2015-01-09 04:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-06-23 21:05 - 2015-01-09 04:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-06-22 09:17 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL 2015-06-22 09:17 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL 2015-06-22 09:17 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL 2015-06-22 09:17 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL 2015-06-22 09:17 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-22 09:23 - 2015-06-19 12:23 - 00001228 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2658783408-2872151984-4163876688-1000UA.job 2015-07-22 09:23 - 2013-07-12 16:35 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-22 09:23 - 2013-07-12 16:13 - 01872179 _____ C:\Windows\WindowsUpdate.log 2015-07-22 09:23 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\LogFiles 2015-07-21 21:39 - 2015-06-19 12:23 - 00001176 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2658783408-2872151984-4163876688-1000Core.job 2015-07-21 14:41 - 2009-07-14 06:34 - 00021264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-07-21 14:41 - 2009-07-14 06:34 - 00021264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-07-21 14:32 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-21 12:33 - 2010-11-20 23:01 - 01620796 _____ C:\Windows\system32\PerfStringBackup.INI 2015-07-21 12:30 - 2014-01-18 21:30 - 00000000 ___RD C:\Users\*****\Dropbox 2015-07-21 12:30 - 2014-01-18 21:29 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox 2015-07-21 09:57 - 2013-07-21 10:34 - 00000000 ____D C:\Program Files\Avira 2015-07-19 11:06 - 2014-09-23 19:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2015-07-19 11:06 - 2013-07-12 16:28 - 00000000 ____D C:\Program Files\Mozilla Firefox 2015-07-18 20:26 - 2014-09-23 19:41 - 00001128 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-07-18 19:42 - 2015-03-25 20:55 - 00000000 ____D C:\AdwCleaner 2015-07-17 09:34 - 2013-07-12 16:35 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-07-17 09:34 - 2013-07-12 16:35 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-07-17 09:33 - 2013-07-12 16:43 - 00000000 ____D C:\Users\*****\AppData\Roaming\SoftGrid Client 2015-07-14 21:09 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default 2015-07-14 21:09 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public 2015-07-14 21:02 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini 2015-07-14 20:45 - 2013-07-12 16:26 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-07-14 11:02 - 2013-07-12 16:21 - 00000000 ____D C:\Users\***** 2015-07-14 10:59 - 2015-04-10 09:56 - 00020480 ___SH C:\Users\*****\Thumbs.db 2015-07-09 20:15 - 2015-03-09 20:44 - 00000000 ____D C:\Users\*****\Desktop\DAK 2015-07-09 15:18 - 2013-07-24 13:26 - 00000000 ____D C:\Windows\Minidump 2015-07-09 12:46 - 2009-07-14 06:33 - 00266744 _____ C:\Windows\system32\FNTCACHE.DAT 2015-07-09 12:23 - 2013-07-24 17:28 - 00059640 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT 2015-07-08 12:42 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\TAPI 2015-07-07 12:09 - 2015-06-09 13:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-07-07 11:41 - 2013-07-21 10:34 - 00000000 ____D C:\ProgramData\Avira 2015-07-07 10:54 - 2014-08-14 09:02 - 00000000 ____D C:\ProgramData\Package Cache 2015-07-03 21:09 - 2014-07-04 20:29 - 00048410 _____ C:\Users\*****\Desktop\Aufstellung Arbeitsstunden.xlsx 2015-07-02 10:31 - 2014-06-05 09:40 - 00000000 __SHD C:\Users\*****\AppData\Local\EmieUserList 2015-07-02 10:31 - 2014-06-05 09:40 - 00000000 __SHD C:\Users\*****\AppData\Local\EmieSiteList 2015-07-02 09:33 - 2015-03-25 22:52 - 00000000 ____D C:\Program Files\ Malwarebytes Anti-Malware 2015-06-25 11:14 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-06-25 11:14 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration 2015-06-24 08:54 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET 2015-06-23 21:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing 2015-06-22 09:04 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat ==================== Files in the root of some directories ======= 2013-08-03 21:20 - 2013-08-03 21:20 - 0007606 _____ () C:\Users\*****\AppData\Local\Resmon.ResmonCfg Some files in TEMP: ==================== C:\Users\*****\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-07-04 09:01 ==================== End of log ============================ FRST Additions Logfile: [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x86) Version: 20-07-2015 Ran by ***** at 2015-07-22 09:32:16 Running from C:\Users\*****\Desktop\trojanerboard\programme Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2658783408-2872151984-4163876688-500 - Administrator - Disabled) Gast (S-1-5-21-2658783408-2872151984-4163876688-501 - Limited - Disabled) => C:\Users\Gast HomeGroupUser$ (S-1-5-21-2658783408-2872151984-4163876688-1002 - Limited - Enabled) ***** (S-1-5-21-2658783408-2872151984-4163876688-1000 - Administrator - Enabled) => C:\Users\***** ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 9.20 (HKLM\...\7-Zip) (Version: - ) Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.8.0.590 - Adobe Systems Incorporated) Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.) Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.210 - Adobe Systems Incorporated) Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.210 - Adobe Systems Incorporated) Adobe Photoshop Elements 10 (HKLM\...\Adobe Photoshop Elements 10) (Version: 10.0 - Adobe Systems Incorporated) Adobe Premiere Elements 10 (HKLM\...\PremElem100) (Version: 10.0 - Adobe Systems Incorporated) Adobe Reader XI (11.0.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.) Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Avira (HKLM\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Avira (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG) Avira Browser Safety (HKLM\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG) Avira System Speedup (HKLM\...\Avira System Speedup_is1) (Version: 1.6.10.1246 - Avira Operations GmbH & Co. KG) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) Browser-Security (HKLM\...\Browser-Security) (Version: 1.0.5.0 - ) Canon Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version: 4.5.0 - Canon Inc.) Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version: - ) Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: - ) Canon MP Navigator EX 2.0 (HKLM\...\MP Navigator EX 2.0) (Version: - ) Canon MP620 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP620_series) (Version: - ) Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 3.0.1 - Canon Inc.) Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 3.0.0 - Canon Inc.) Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version: - ) Cisco EAP-FAST Module (HKLM\...\{415B2719-AD3A-4944-B404-C472DB6085B3}) (Version: 2.1.6 - Cisco Systems, Inc.) Cisco LEAP Module (HKLM\...\{83770D14-21B9-44B3-8689-F7B523F94560}) (Version: 1.0.12 - Cisco Systems, Inc.) Cisco PEAP Module (HKLM\...\{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}) (Version: 1.0.13 - Cisco Systems, Inc.) Dell Resource CD (HKLM\...\{42929F0F-CE14-47AF-9FC7-FF297A603021}) (Version: 1.00.0000 - Ihr Firmenname) Dell Support Center (HKLM\...\{E3BFEE55-39E2-4BE0-B966-89FE583822C1}) (Version: 2.1.08060 - Dell) Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.2.101.224 - ALPS ELECTRIC CO., LTD.) Dell Wireless WLAN Card Utility (HKLM\...\Broadcom 802.11 Application) (Version: 5.10.38.30 - Dell Inc.) Digital Photo Navigator 1.5 (HKLM\...\{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}) (Version: - ) Dropbox (HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\Dropbox) (Version: 3.6.8 - Dropbox, Inc.) Dropbox (HKU\S-1-5-21-2658783408-2872151984-4163876688-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.6.8 - Dropbox, Inc.) Elements 10 Organizer (Version: 10.0 - Ihr Firmenname) Hidden ElsterFormular (HKLM\...\ElsterFormular) (Version: 16.1.16483 - Landesfinanzdirektion Thüringen) Ericsson Wireless Manager (HKLM\...\{FF203294-02C1-4632-832C-762CBD15CF2D}) (Version: 5.2.1045.57 - Dell) Everio MediaBrowser (HKLM\...\{5CA03ECF-B4A6-464B-9F5D-64D8B61B083F}) (Version: 1.00.013 - PIXELA) IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.32 - Irfan Skiljan) iTunes (HKLM\...\{E05D82D8-FE70-4228-B073-B0C07FE27595}) (Version: 11.1.1.11 - Apple Inc.) Java 8 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) LG Bluetooth Drivers (HKLM\...\{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}) (Version: 1.1 - LG Electronics) LG United Mobile Drivers (HKLM\...\{7BF5C379-41FF-4C6D-842C-DF82D74C2B14}) (Version: 3.7.2.0 - LG Electronics) MaintenanceService 1.0.0 (HKLM\...\zz.544.mcc) (Version: 1.0.0 - CSDI) Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation) Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Klick-und-Los 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Starter 2010 - Deutsch (HKLM\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation) Mobile Broadband HL Service (HKLM\...\Mobile Broadband HL Service) (Version: 22.001.21.00.03 - Huawei Technologies Co.,Ltd) Modem Diagnostics Tool (HKLM\...\{1882D3BE-8B8F-4EA3-9414-EB06CD5B9CD8}) (Version: 1.0.22.0 - Dell) Mozilla Firefox 39.0 (x86 de) (HKLM\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla) Mozilla Thunderbird 31.7.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation) PDF24 Creator 6.9.2 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Photo Notifier and Animation Creator (HKLM\...\Photo Notifier and Animation Creator) (Version: 1.0.0.1009 - IncrediMail Ltd.) PhotoScape (HKLM\...\PhotoScape) (Version: - ) Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) PokerStars.eu (HKLM\...\PokerStars.eu) (Version: - PokerStars.eu) PRE10STIInstaller (Version: 1.0 - Adobe Systems Incorporated) Hidden PSE10 STI Installer (Version: 10.0 - Adobe Systems Incorporated) Hidden Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version: - ) RICOH Media Driver ver.2.07.01.00 (HKLM\...\{2B818257-E6C7-4841-8C29-C5C9A982BCE5}) (Version: 2.07.01.00 - RICOH) Security Task Manager 2.0d (HKLM\...\Security Task Manager) (Version: 2.0d - Neuber Software) SmartSound Common Data (HKLM\...\InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}) (Version: 1.1.0 - SmartSound Software Inc.) SmartSound Common Data (Version: 1.1.0 - SmartSound Software Inc.) Hidden SmartSound Premiere Elements 10 Plugin (HKLM\...\{0E16C1BC-72A7-4DB7-BBB8-560EDCCA74B5}) (Version: 5.70.0001 - SmartSound Software Inc.) SmartSound Sonicfire Pro 5 (HKLM\...\InstallShield_{1D273D91-D7D5-4036-8B84-EB4615FF5F81}) (Version: 5.7.1 - SmartSound Software Inc.) SmartSound Sonicfire Pro 5 (Version: 5.7.1 - SmartSound Software Inc.) Hidden SpywareBlaster 5.0 (HKLM\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC) swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.24951 - TeamViewer) Winmail Opener 1.4 (HKLM\...\Winmail Opener) (Version: 1.4 - Eolsoft) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF}\InprocServer32 -> C:\Users\*****\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{3059C9E6-9EDC-4C89-933E-C65623F8FD60}\localserver32 -> C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{38911D8E-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\Windows\system32\comct332.ocx (Microsoft Corporation ) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{38911D90-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\Windows\system32\comct332.ocx (Microsoft Corporation ) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{38911D92-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\Windows\system32\comct332.ocx (Microsoft Corporation ) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{586A6352-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{586A6353-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{586A6354-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{586A6355-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{586A6356-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{586A6357-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{586A6359-87C8-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{87DC457B-B35D-48AC-BD42-BDF35EF623CE}\localserver32 -> C:\Users\*****\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{9FAA38ED-5635-44F7-9BE0-8CAFE29B3783}\localserver32 -> C:\Users\*****\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No Filepath CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{C0DD324D-A74F-4533-84AD-030F76771C77}\localserver32 -> C:\Users\*****\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{C32E3EEC-3C10-426E-95F3-38C7F139FADD}\localserver32 -> C:\Users\*****\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\InprocServer32 -> C:\Windows\system32\mscomct2.ocx (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000_Classes\CLSID\{FE819BE5-BADF-4370-9913-6FB84ABA6FB1}\InprocServer32 -> C:\Users\*****\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.) ==================== Restore Points ========================= 09-07-2015 12:21:37 Avira System Speedup 1.6.5 09-07-2015 12:27:24 Avira System Speedup 1.6.10 14-07-2015 20:47:03 ComboFix created restore point 18-07-2015 19:48:05 JRT Pre-Junkware Removal 21-07-2015 09:58:11 Avira System Speedup 1.6.10 ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:04 - 2015-07-14 20:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {1A48A01E-08C1-4D40-A8DF-B6A606D96057} - System32\Tasks\{A92944FD-F0B9-4234-B874-4024D4477A1A} => pcalua.exe -a C:\Users\*****\Downloads\smwin143de.exe -d C:\Users\*****\Downloads Task: {2A647CF5-04D3-4C36-BE56-6D9482AE2575} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2015-06-17] (Avira Operations GmbH & Co. KG) Task: {4A07045C-1EFA-4BF9-9F7F-C0A8C69E6DAC} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2658783408-2872151984-4163876688-1000UA => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.) Task: {53BCA81D-C5E3-4C18-AC7D-72E3043C1579} - System32\Tasks\{8F7467BB-3E53-4C26-A088-5C10E86EC387} => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [2009-09-04] (CANON INC.) Task: {5CA41FFE-1409-44E9-A716-FB88A759EDE1} - System32\Tasks\{C1569C5F-25C8-490B-97F1-7E6F2EA91ECA} => pcalua.exe -a "C:\Program Files\LG Electronics\LG Bluetooth Drivers\UninstallShld.exe" -d C:\Windows\system32 -c C:\Program Files\LG Electronics\LG Bluetooth Drivers Task: {AD190E38-CF11-45A4-A00E-3D3F1466D5AE} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2658783408-2872151984-4163876688-1000Core => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.) Task: {B521A6D2-F19C-480E-89FC-F83D4E408438} - System32\Tasks\{395E5F92-BDD4-476A-BE90-74251E11422D} => pcalua.exe -a E:\ZIPFILES\_R194237.EXE -d E:\ZIPFILES Task: {BB54A577-3CB8-4986-8455-60A2594A563C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-17] (Adobe Systems Incorporated) Task: {BE55F000-A252-4339-8481-B1FCD1788CC8} - System32\Tasks\Avira Browser Safety Updater Task => C:\Program Files\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe [2015-03-11] (Avira Operations GmbH & Co. KG) Task: {C90B4669-4C79-4C10-A4E4-506868621643} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated) Task: {CAA932AC-F0A8-421C-91C7-29017F1ED91C} - System32\Tasks\{9EBBAC0B-B4DF-446B-8A9A-9F04CFD56246} => pcalua.exe -a E:\ZIPFILES\_R194235.EXE -d E:\ZIPFILES Task: {D60CD9CB-6499-499E-9ABD-1F4929E90D49} - System32\Tasks\{2B175F30-DB77-4283-9289-0C0D17830036} => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [2009-09-04] (CANON INC.) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2658783408-2872151984-4163876688-1000Core.job => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2658783408-2872151984-4163876688-1000UA.job => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe ==================== Loaded Modules (Whitelisted) ============== 2013-07-12 17:01 - 2008-11-17 07:29 - 00026112 _____ () C:\Windows\System32\WLTRYSVC.EXE 2013-07-12 17:01 - 2008-11-17 07:29 - 00054784 _____ () C:\Windows\System32\bcmwlrmt.dll 2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2015-01-26 16:34 - 2013-07-23 05:47 - 00239696 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\008i.com -> 008i.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\008k.com -> 008k.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\00hq.com -> 00hq.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\0190-dialers.com -> 0190-dialers.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\01i.info -> 01i.info IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\0411dd.com -> 0411dd.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\0511zfhl.com -> 0511zfhl.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\05p.com -> 05p.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\0632qyw.com -> 0632qyw.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\0calories.net -> 0calories.net IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\0cj.net -> 0cj.net IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\0scan.com -> 0scan.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\1-domains-registrations.com -> 1-domains-registrations.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\1-se.com -> 1-se.com IE restricted site: HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\...\1001movie.com -> 1001movie.com There are 6091 more restricted sites. ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2658783408-2872151984-4163876688-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg HKU\S-1-5-21-2658783408-2872151984-4163876688-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg HKU\S-1-5-21-2658783408-2872151984-4163876688-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\Scanner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg HKU\S-1-5-21-2658783408-2872151984-4163876688-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Scanner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg HKU\S-1-5-21-2658783408-2872151984-4163876688-501\Control Panel\Desktop\\Wallpaper -> C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg HKU\S-1-5-21-2658783408-2872151984-4163876688-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.178.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MBCameraMonitor.lnk => C:\Windows\pss\MBCameraMonitor.lnk.CommonStartup MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" MSCONFIG\startupreg: Broadcom Wireless Manager UI => C:\Windows\system32\WLTRAY.exe MSCONFIG\startupreg: DellSupportCenter => "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter MSCONFIG\startupreg: Dropbox Update => "C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c MSCONFIG\startupreg: dscactivate => "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{85599A72-E26C-46F3-89D0-B837945A236F}] => (Allow) C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe FirewallRules: [{610645C8-B63A-408D-AA9E-AC847FD7D023}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{96FB713E-3710-46FD-8178-9325EE7DEADE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{DCB211D4-62B3-4A00-8248-E626DF572CC9}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [TCP Query User{ABF8BBE6-5B64-4C9C-BBB3-E5F4A2AC2F76}C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe FirewallRules: [UDP Query User{C55F8FF1-2DF3-4B2A-ABE6-B3EB083E5FBC}C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe FirewallRules: [{F2BAB387-2E42-4DC0-AC82-7486EB647FCA}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe FirewallRules: [{8543C986-7BA0-40EF-A337-193EB2F30115}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe FirewallRules: [{B8A5AF3B-6FFE-4EA1-98A5-23384D4748B2}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe FirewallRules: [{58895474-99A4-4AE6-83FF-0B04AD68A410}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe FirewallRules: [{EB581668-FA28-4F3F-8E94-A7FED21BA583}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe FirewallRules: [{B1A820FD-1279-4CC4-AC77-B12299558573}] => (Allow) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe FirewallRules: [{9B59272F-3CFF-4686-82A7-C0871A2A64CF}] => (Allow) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe FirewallRules: [{F77FDC70-8E5A-4A5D-A30A-9DA655131490}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{B57F3F73-D8DF-4EAF-9D12-1DE640680539}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Faulty Device Manager Devices ============= Name: Canon MP620 ser Network Description: Canon MP620 ser Network Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f} Manufacturer: Canon Service: StillCam Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (07/21/2015 09:39:48 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 8596 Error: (07/21/2015 09:39:48 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 8596 Error: (07/21/2015 09:39:48 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/21/2015 09:39:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 7597 Error: (07/21/2015 09:39:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 7597 Error: (07/21/2015 09:39:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/21/2015 09:39:46 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 6552 Error: (07/21/2015 09:39:46 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 6552 Error: (07/21/2015 09:39:46 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/21/2015 09:39:45 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 5491 System errors: ============= Error: (07/18/2015 07:49:45 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error: (07/18/2015 07:49:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Adobe Active File Monitor V10" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (07/18/2015 07:49:43 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts. Error: (07/18/2015 07:49:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Application Virtualization Client" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (07/18/2015 07:49:43 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Avira Email-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts. Error: (07/18/2015 07:49:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Client Virtualization Handler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (07/18/2015 07:49:41 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts. Error: (07/18/2015 07:49:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "SupportSoft Sprocket Service (dellsupportcenter)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (07/18/2015 07:49:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Application Virtualization Service Agent" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (07/18/2015 07:49:40 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Mobile Broadband HL Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Microsoft Office: ========================= Error: (07/21/2015 09:39:48 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 8596 Error: (07/21/2015 09:39:48 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 8596 Error: (07/21/2015 09:39:48 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/21/2015 09:39:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 7597 Error: (07/21/2015 09:39:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 7597 Error: (07/21/2015 09:39:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/21/2015 09:39:46 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 6552 Error: (07/21/2015 09:39:46 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 6552 Error: (07/21/2015 09:39:46 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (07/21/2015 09:39:45 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 5491 ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz Percentage of memory in use: 46% Total physical RAM: 3030.89 MB Available physical RAM: 1612.16 MB Total Virtual: 6060.1 MB Available Virtual: 4111.24 MB ==================== Drives ================================ Drive c: (win7-32) (Fixed) (Total:270.35 GB) (Free:181.86 GB) NTFS Drive d: (Daten) (Fixed) (Total:195.31 GB) (Free:156.6 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1EFCCBBE) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=270.4 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=195.3 GB) - (Type=07 NTFS) ==================== End of log ============================ --- --- --- |
23.07.2015, 05:41 | #17 |
/// the machine /// TB-Ausbilder | Windows 7: Adware EoRezo kommt täglich Cleanup:
__________________(Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde: Combofix deinstallieren .
Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen. Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung: Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional: NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen. Lade Software von einem sauberen Portal wie . Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ |
23.07.2015, 09:48 | #18 |
| Windows 7: Adware EoRezo kommt täglich Hallo Schrauber,
__________________vielen Dank für Deine Hilfe. Ein Problem habe ich aber noch. Ich wollte die ComboFix deinstallieren, aber wenn ich Deine Schritte anwende, dann bekomme ich die Meldung, dass das Programm nicht da wäre oder ich die Schreibweise prüfen soll. Ich habe schon sämtliche Schreibweisen ausprobiert, aber das Programm wird nicht deinstalliert. Ich kann es nur in dem Ordner per "Entfernen" löschen. Sind dann aber alle Dateien weg? Danke und Grüße knisbits |
24.07.2015, 06:26 | #19 |
/// the machine /// TB-Ausbilder | Windows 7: Adware EoRezo kommt täglich Wo genau liegt Combofix bei dir?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
24.07.2015, 11:10 | #20 |
| Windows 7: Adware EoRezo kommt täglich Hallo Schrauber, das Programm ist in einem gesonderten Ordner auf dem Desktop. Ich habe es aber auch schon auf den Desktop verschoben und er konnte es nicht finden. Gruss knisbits |
25.07.2015, 09:46 | #21 |
/// the machine /// TB-Ausbilder | Windows 7: Adware EoRezo kommt täglich Auf den Desktop schieben, keine Verknüpfung. Dann WIndows-Taste +R, schreibe: "%userprofile%\desktop\Combofix.exe" /Uninstall
__________________ --> Windows 7: Adware EoRezo kommt täglich |
Themen zu Windows 7: Adware EoRezo kommt täglich |
abgesicherten, adware, avira, dateien, gen, malwarebytes, malwarebytes premium, manager, meldungen, modus, mozilla, ordner, programm, programme, scan, scanner, security, speicher, suite, task manager, trotz, update, virenscanner, windows, windows 7, windows update |