| |
| |||||||
Log-Analyse und Auswertung: Windows 8.1 ACER XC-115 EU Cleaner findet TR/Elenoocka.vvre und TR/Crypt.ZPACK.186038Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.10.2015, 15:07
| #1 |
 |  Windows 8.1 ACER XC-115 EU Cleaner findet TR/Elenoocka.vvre und TR/Crypt.ZPACK.186038 Hallo zusammen, mein EU Cleaner von AVIRA fand heute die beiden Trojaner TR/Elenoocka.vvre und TR/Crypt.ZPACK.186038. Diese wollte ich durch den EU Cleaner entfernen lassen ging aber nicht, wurden nicht entfernt. Habe Defogger, FRST und GMER runtergeladen und ausgeführt. Defogger und FRST haben txt. aufs Desktop geladen. GMER lässt sich nicht starten, mit dem Hinweis- unbekannter Fehler. Hier die Logs Zusammenfassung des Suchlaufs: ************************************************** Zeitstempel des letzten Updates: 08.10.2015 08:17:28 Konfigurationsprofil: sysscan.avp Plattform : Windows 8.1 Windowsversion : (plain) [6.2.9200] build.dat : 10.0.0.65 13423 Bytes 07.04.2014 08:37:00 AVIRA - Beginn des Suchlaufs: Donnerstag, 8. Oktober 2015 10:18 8dc88fbaedf46225cd715fd4f29d34e86a57a8b88b71ae6d2dc0640d14db20e1 [FUND] Ist das Trojanische Pferd TR/Elenoocka.vvre 5137d0c03fb37a03338867d1854390b39fd4295284b0b18db75e071deea12104 [FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.186038 Ende des Suchlaufs: Donnerstag, 8. Oktober 2015 11:57 Benötigte Zeit: 1:39:26 Stunde(n) AVIRA - Der Suchlauf wurde abgebrochen! 43476 Verzeichnisse wurden überprüft 804993 Dateien wurden geprüft 3 Viren bzw. unerwünschte Programme wurden gefunden 0 Dateien wurden als verdächtig eingestuft 0 Dateien wurden gelöscht 0 Viren bzw. unerwünschte Programme wurden repariert 0 Dateien wurden in die Quarantäne verschoben 0 Dateien wurden umbenannt 3448 Dateien konnten nicht durchsucht werden 801542 Dateien ohne Befall 9635 Archive wurden durchsucht 3450 Warnungen 0 Hinweise defogger_disable by jpshortstuff (23.02.10.1) Log created at 14:10 on 08/10/2015 (maddin) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:07-10-2015 durchgeführt von maddin (Administrator) auf ACERXC115 (08-10-2015 14:12:29) Gestartet von C:\Users\maddin\Desktop Geladene Profile: maddin (Verfügbare Profile: maddin & Administrator) Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (AMD) C:\Windows\System32\atiesrxx.exe (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\tbaseprovisioning.exe (Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe (ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe () C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe (Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe (Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.) C:\Program Files\mcafee\MSC\McAPExe.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe (WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.6.1008.0\McCSPServiceHost.exe (acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (AMD) C:\Windows\System32\atieclxx.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (McAfee Inc.) C:\Program Files\mcafee\Raptor\Raptor.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe (Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe (Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe (Acer) C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe () C:\Program Files (x86)\Acer\Care Center\ACCStd.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Pokki) C:\Users\maddin\AppData\Local\Pokki\Engine\ServiceHostAppUpdater.exe (Pokki) C:\Users\maddin\AppData\Local\Pokki\Engine\ServiceHostApp.exe (Pokki) C:\Users\maddin\AppData\Local\Pokki\Engine\ServiceHostApp.exe (Pokki) C:\Users\maddin\AppData\Local\Pokki\Engine\ServiceStartMenuIndexer.exe (The Document Foundation) C:\Program Files (x86)\LibreOffice 4\program\swriter.exe (The Document Foundation) C:\Program Files (x86)\LibreOffice 4\program\soffice.exe (The Document Foundation) C:\Program Files (x86)\LibreOffice 4\program\soffice.bin (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Marcor Online) C:\Program Files\WindowsApps\8251MarcoRinaldi.NoteTiles_8.1.1.0_x64__9rvmmrcs6zgr6\Sticky Notes 8.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13642968 2013-08-13] (Realtek Semiconductor) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-04-15] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [36710768 2015-10-02] (Dropbox, Inc.) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2620728 2015-07-22] (Malwarebytes Corporation) HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [74752 2015-09-01] () HKLM-x32\...\Run: [TrojanScanner] => C:\Program Files (x86)\Trojan Remover\Trjscan.exe [3716624 2015-09-14] (Simply Super Software) HKLM\...\RunOnce: [Raptor] => C:\Program Files\mcafee\Raptor\Raptor.exe [1757552 2015-09-14] (McAfee Inc.) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [133760 2013-12-24] (Atheros Communications) HKLM\...\Policies\Explorer: [NoFolderOptions] 0 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\...\Run: [AcerPortal] => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2665984 2015-08-13] (Acer) HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [787592 2015-09-21] (Sandboxie Holdings, LLC) HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation) HKU\S-1-5-18\...\Run: [abDocsDllLoader] => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe [1769312 2015-07-27] () ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-07-23] (Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-07-23] (Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2015-07-23] (Acer Incorporated) ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-08-23] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe (McAfee, Inc.) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [345360 2015-09-07] (Lavasoft Limited) Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [345360 2015-09-07] (Lavasoft Limited) Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [345360 2015-09-07] (Lavasoft Limited) Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [345360 2015-09-07] (Lavasoft Limited) Winsock: Catalog9 16 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [345360 2015-09-07] (Lavasoft Limited) Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-09-07] (Lavasoft Limited) Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-09-07] (Lavasoft Limited) Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-09-07] (Lavasoft Limited) Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-09-07] (Lavasoft Limited) Winsock: Catalog9-x64 16 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-09-07] (Lavasoft Limited) Hosts: 0.0.0.1 mssplus.mcafee.com Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{47B9202D-2068-4C09-8392-2B3B3F346D5C}: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{DD0CA432-DA49-442F-8646-D239044AFC10}: [DhcpNameServer] 172.19.0.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-3121378926-3824479896-3812363718-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKU\S-1-5-21-3121378926-3824479896-3812363718-1001 -> DefaultScope {B64C9344-4CB5-11E5-8266-3010B3F37793} URL = SearchScopes: HKU\S-1-5-21-3121378926-3824479896-3812363718-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3121378926-3824479896-3812363718-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = SearchScopes: HKU\S-1-5-21-3121378926-3824479896-3812363718-1001 -> {ED63702C-F9B4-415A-8DD1-7DD29BC5BB3E} URL = BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24] (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO-x32: E-Web Print -> {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} -> C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24] (SEIKO EPSON CORPORATION / CyCom Technology Corp.) Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION) Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2015-09-22] (McAfee, Inc.) Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2015-09-22] (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2015-09-22] (McAfee, Inc.) Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2015-09-22] (McAfee, Inc.) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\MSC\McSnIePl64.dll [2015-08-21] (McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-08-21] (McAfee, Inc.) FireFox: ======== FF ProfilePath: C:\Users\maddin\AppData\Roaming\Mozilla\Firefox\Profiles\ip5f7avp.default-1442067491329 FF Homepage: hxxp://homepage-web.com/?s=acer&m=start FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-23] () FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-08-21] () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-23] () FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation) FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation) FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation) FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation) FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-08-21] () FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-06] () FF SearchPlugin: C:\Users\maddin\AppData\Roaming\Mozilla\Firefox\Profiles\ip5f7avp.default-1442067491329\searchplugins\McSiteAdvisor.xml [2015-10-08] FF Extension: YouTube mp3 - C:\Users\maddin\AppData\Roaming\Mozilla\Firefox\Profiles\ip5f7avp.default-1442067491329\Extensions\info@youtube-mp3.org.xpi [2015-09-16] FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi FF Extension: Kein Name - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2015-09-25] FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on FF Extension: E-Web Print - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2015-08-09] FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2015-09-05] Chrome: ======= CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-09-25] CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-09-25] ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [140288 2014-04-15] () [Datei ist nicht signiert] R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [318592 2013-12-24] (Windows (R) Win 7 DDK provider) [Datei ist nicht signiert] R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2858336 2015-07-23] (Acer Incorporated) S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-08-08] (Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-08-08] (Dropbox, Inc.) R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2015-09-01] (Freemake) [Datei ist nicht signiert] R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2015-09-01] (Ellora Assets Corp.) [Datei ist nicht signiert] R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent) R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368048 2015-07-21] (McAfee, Inc.) R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [713016 2015-07-22] (Malwarebytes Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [157928 2015-09-22] (McAfee, Inc.) R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [782608 2015-08-21] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.163\McCHSvc.exe [289256 2015-07-31] (McAfee, Inc.) R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.6.1008.0\McCSPServiceHost.exe [1694152 2015-07-23] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368048 2015-07-21] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368048 2015-07-21] (McAfee, Inc.) S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [639456 2015-07-17] (McAfee, Inc.) R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368048 2015-07-21] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368048 2015-07-21] (McAfee, Inc.) R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232656 2015-06-29] (McAfee, Inc.) R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [373704 2015-07-15] (McAfee, Inc.) R3 mfevtp; C:\WINDOWS\system32\mfevtps.exe [254792 2015-06-29] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [368048 2015-07-21] (McAfee, Inc.) R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [458984 2014-06-26] (Acer Incorporate) R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [177800 2015-09-21] (Sandboxie Holdings, LLC) R2 tbaseprovisioning; C:\Windows\SysWOW64\tbaseprovisioning.exe [51712 2014-02-24] (Advanced Micro Devices, Inc.) R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-14] (acer) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17640 2013-10-23] (Advanced Micro Devices, INC.) S3 amdkmcsp; C:\Windows\system32\DRIVERS\amdkmcsp.sys [85704 2014-02-24] (Advanced Micro Devices, Inc. ) R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2013-12-13] (Advanced Micro Devices, Inc.) R0 amdpsp; C:\Windows\System32\DRIVERS\amdpsp.sys [230088 2014-02-24] (Advanced Micro Devices, Inc. ) R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881472 2013-12-12] (Qualcomm Atheros Communications, Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices) S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation) R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-12-24] (Qualcomm Atheros) R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation) R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [77536 2015-07-02] (McAfee, Inc.) S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation) R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2015-07-22] () R3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.) S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [41080 2015-09-29] () R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-10-06] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation) R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [412440 2015-07-02] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [347800 2015-07-02] (McAfee, Inc.) S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [80920 2015-07-02] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496888 2015-07-02] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [875928 2015-07-02] (McAfee, Inc.) R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [529080 2015-06-28] (McAfee, Inc.) S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [109728 2015-06-28] (McAfee, Inc.) R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [37960 2015-09-22] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344704 2015-07-02] (McAfee, Inc.) R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.) R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [191624 2015-09-21] (Sandboxie Holdings, LLC) U5 TMUSB; C:\Windows\System32\DRIVERS\TMUSB64.SYS [63096 2015-05-25] (Seiko Epson Corporation) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation) ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-10-08 14:12 - 2015-10-08 14:13 - 00027432 _____ C:\Users\maddin\Desktop\FRST.txt 2015-10-08 14:12 - 2015-10-08 14:12 - 00000000 ____D C:\FRST 2015-10-08 14:11 - 2015-10-08 14:11 - 00380416 _____ C:\Users\maddin\Desktop\Gmer-19357.exe 2015-10-08 14:09 - 2015-10-08 14:10 - 00000474 _____ C:\Users\maddin\Desktop\defogger_disable.log 2015-10-08 14:09 - 2015-10-08 14:09 - 00029646 _____ C:\Users\maddin\Documents\trojanerboard anleitung einführung.odt 2015-10-08 14:09 - 2015-10-08 14:09 - 00000000 _____ C:\Users\maddin\defogger_reenable 2015-10-08 14:04 - 2015-10-08 14:04 - 02193920 _____ (Farbar) C:\Users\maddin\Desktop\FRST64.exe 2015-10-08 14:03 - 2015-10-08 14:03 - 01697792 _____ (Farbar) C:\Users\maddin\Desktop\FRST.exe 2015-10-08 14:00 - 2015-10-08 14:00 - 00050477 _____ C:\Users\maddin\Desktop\Defogger.exe 2015-10-08 13:52 - 2015-10-08 14:14 - 00017999 _____ C:\Users\maddin\Documents\Eu Cleaner Trojanerfunde 08.10.2015.odt 2015-10-08 08:56 - 2015-10-08 08:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2015-10-04 17:42 - 2015-10-04 17:42 - 00282080 _____ C:\WINDOWS\Minidump\100415-16265-01.dmp 2015-10-04 11:20 - 2015-10-04 17:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-10-04 11:00 - 2015-10-04 11:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-09-29 12:21 - 2015-09-29 12:21 - 00000036 _____ C:\Users\maddin\AppData\Local\housecall.guid.cache 2015-09-29 12:20 - 2015-09-29 12:21 - 02405664 _____ (Trend Micro Inc.) C:\Users\maddin\Downloads\HousecallLauncher64.exe 2015-09-29 12:11 - 2015-09-29 12:11 - 00041080 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys 2015-09-29 12:09 - 2015-09-29 12:09 - 00000842 _____ C:\WINDOWS\system32\.crusader 2015-09-29 12:01 - 2015-09-29 12:01 - 00001925 _____ C:\Users\Public\Desktop\HitmanPro.lnk 2015-09-29 12:01 - 2015-09-29 12:01 - 00000000 ____D C:\Program Files\HitmanPro 2015-09-29 12:00 - 2015-09-29 12:09 - 00000000 ____D C:\ProgramData\HitmanPro 2015-09-29 11:59 - 2015-09-29 12:00 - 11350472 _____ (SurfRight B.V.) C:\Users\maddin\Downloads\hitmanpro_x64.exe 2015-09-29 11:54 - 2015-09-29 11:54 - 00000000 _____ C:\Users\maddin\Downloads\Stinger_29092015_115424.html 2015-09-29 11:53 - 2015-09-29 11:53 - 00992908 _____ C:\Users\maddin\Downloads\runtime.dat 2015-09-29 11:51 - 2015-09-29 11:51 - 00000000 ____D C:\Users\Public\Documents\sun 2015-09-28 20:02 - 2015-09-28 20:02 - 00001167 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-09-28 19:45 - 2015-09-28 19:45 - 00282080 _____ C:\WINDOWS\Minidump\092815-20296-01.dmp 2015-09-25 13:20 - 2015-10-04 21:16 - 00001478 _____ C:\WINDOWS\Sandboxie.ini 2015-09-25 13:20 - 2015-09-25 13:20 - 00000930 _____ C:\Users\maddin\Desktop\Sandboxed Web Browser.lnk 2015-09-25 13:20 - 2015-09-25 13:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie 2015-09-25 13:19 - 2015-09-25 13:20 - 00000000 ____D C:\Program Files\Sandboxie 2015-09-25 13:18 - 2015-09-25 13:19 - 08518280 _____ (Sandboxie Holdings, LLC) C:\Users\maddin\Downloads\SandboxieInstall.exe 2015-09-16 21:27 - 2015-09-16 21:33 - 05203310 _____ C:\Users\maddin\Downloads\Xandria - Sacrificium (With Lyrics).mp3.part 2015-09-16 18:33 - 2015-09-28 20:05 - 00002048 _____ C:\Users\maddin\Desktop\Entfernen des Avira EU-Cleaners.lnk 2015-09-16 18:33 - 2015-09-28 20:05 - 00001992 _____ C:\Users\maddin\Desktop\Avira EU-Cleaner.lnk 2015-09-14 17:49 - 2015-09-14 17:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.4 2015-09-14 15:23 - 2015-09-14 17:30 - 224563200 _____ C:\Users\maddin\Downloads\LibreOffice_4.4.5_Win_x86.msi 2015-09-14 15:05 - 2015-09-29 11:53 - 00000000 ____D C:\Program Files\stinger 2015-09-14 15:04 - 2015-09-14 15:04 - 15309168 _____ (McAfee Inc) C:\Users\maddin\Downloads\stinger64(1).exe 2015-09-14 14:59 - 2015-09-14 14:59 - 00000000 ____D C:\ProgramData\Licenses 2015-09-14 14:55 - 2015-09-14 14:55 - 00001159 _____ C:\Users\Public\Desktop\Trojan Remover.lnk 2015-09-14 14:52 - 2015-09-14 14:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover 2015-09-14 14:52 - 2015-09-14 14:52 - 00000000 ____D C:\Users\maddin\AppData\Roaming\Simply Super Software 2015-09-14 14:51 - 2015-09-14 14:57 - 00000000 ____D C:\Program Files (x86)\Trojan Remover 2015-09-14 14:51 - 2015-09-14 14:51 - 00000000 ____D C:\ProgramData\Simply Super Software 2015-09-14 12:30 - 2015-09-14 12:30 - 00001992 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2015-09-14 12:30 - 2015-09-14 12:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2015-09-14 12:29 - 2015-09-14 12:29 - 00000000 ____D C:\Program Files\McAfee Security Scan 2015-09-14 12:28 - 2015-09-14 12:29 - 08709384 _____ (McAfee, Inc.) C:\Users\maddin\Downloads\SecurityScan_Release.exe 2015-09-09 20:15 - 2015-08-27 04:48 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2015-09-09 20:15 - 2015-08-26 20:00 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2015-09-09 20:15 - 2015-08-26 20:00 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll 2015-09-09 20:15 - 2015-08-26 20:00 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2015-09-09 20:15 - 2015-08-26 20:00 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe 2015-09-09 20:15 - 2015-08-26 16:46 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2015-09-09 20:15 - 2015-08-26 16:29 - 02240512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll 2015-09-09 20:15 - 2015-08-26 16:27 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2015-09-09 20:15 - 2015-08-26 16:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll 2015-09-09 20:15 - 2015-08-26 16:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll 2015-09-09 20:15 - 2015-08-26 16:26 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2015-09-09 20:15 - 2015-08-26 16:26 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe 2015-09-09 20:14 - 2015-09-03 04:18 - 02531400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-09-09 20:14 - 2015-09-03 04:17 - 01903848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-09-09 20:14 - 2015-09-02 20:48 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-09-09 20:14 - 2015-09-02 19:09 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-09-09 20:14 - 2015-08-22 20:19 - 25188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-09-09 20:14 - 2015-08-22 19:22 - 19856384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-09-09 20:14 - 2015-07-30 19:18 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\InkEd.dll 2015-09-09 20:14 - 2015-07-30 18:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InkEd.dll 2015-09-09 20:14 - 2015-07-22 16:19 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll 2015-09-09 20:14 - 2015-07-22 15:52 - 01633792 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll 2015-09-09 20:14 - 2015-07-17 16:15 - 00951296 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll 2015-09-09 20:14 - 2015-07-17 16:10 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll 2015-09-09 20:14 - 2015-06-27 13:47 - 00118616 _____ (Microsoft Corporation) C:\WINDOWS\system32\consent.exe 2015-09-09 20:13 - 2015-09-02 04:56 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2015-09-09 20:13 - 2015-09-02 04:55 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2015-09-09 20:13 - 2015-09-02 04:50 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2015-09-09 20:13 - 2015-09-02 04:17 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2015-09-09 20:13 - 2015-09-02 04:13 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2015-09-09 20:13 - 2015-08-22 19:35 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-09-09 20:13 - 2015-08-22 19:34 - 00585216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-09-09 20:13 - 2015-08-22 19:21 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-09-09 20:13 - 2015-08-22 19:20 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-09-09 20:13 - 2015-08-22 18:55 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-09-09 20:13 - 2015-08-22 18:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-09-09 20:13 - 2015-08-22 18:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2015-09-09 20:13 - 2015-08-22 18:45 - 00665600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-09-09 20:13 - 2015-08-22 18:44 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2015-09-09 20:13 - 2015-08-22 18:41 - 14451712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-09-09 20:13 - 2015-08-22 18:41 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-09-09 20:13 - 2015-08-22 18:41 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2015-09-09 20:13 - 2015-08-22 18:41 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2015-09-09 20:13 - 2015-08-22 18:39 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-09-09 20:13 - 2015-08-22 18:28 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-09-09 20:13 - 2015-08-22 18:26 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-09-09 20:13 - 2015-08-22 18:23 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2015-09-09 20:13 - 2015-08-22 18:22 - 12857344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-09-09 20:13 - 2015-08-22 18:20 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2015-09-09 20:13 - 2015-08-22 18:18 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2015-09-09 20:13 - 2015-08-22 18:18 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-09-09 20:13 - 2015-08-22 18:18 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2015-09-09 20:13 - 2015-08-22 18:14 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-09-09 20:13 - 2015-08-22 18:01 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2015-09-09 20:13 - 2015-08-22 18:00 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-09-09 20:13 - 2015-08-22 17:56 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-09-09 20:13 - 2015-08-22 17:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2015-09-09 20:13 - 2015-08-01 05:47 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\schtasks.exe 2015-09-09 20:13 - 2015-08-01 05:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schtasks.exe 2015-09-09 20:13 - 2015-08-01 05:38 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll 2015-09-09 20:13 - 2015-08-01 05:37 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskeng.exe 2015-09-09 20:13 - 2015-08-01 05:37 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskeng.exe 2015-09-09 20:13 - 2015-07-22 16:34 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2015-09-09 20:13 - 2015-07-22 16:33 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll 2015-09-09 20:13 - 2015-07-22 16:25 - 02461184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2015-09-09 20:13 - 2015-07-22 16:25 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll 2015-09-09 20:13 - 2015-07-18 20:31 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll 2015-09-09 20:13 - 2015-07-18 20:29 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll 2015-09-09 20:13 - 2015-07-18 20:29 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll 2015-09-09 20:13 - 2015-07-18 20:27 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll 2015-09-09 20:13 - 2015-07-13 21:10 - 00411455 _____ C:\WINDOWS\system32\ApnDatabase.xml 2015-09-09 20:13 - 2015-07-09 18:14 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-09-09 20:13 - 2015-07-03 23:51 - 01380056 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll 2015-09-09 20:13 - 2015-07-03 16:00 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll 2015-09-09 20:13 - 2015-06-19 19:07 - 02819072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll 2015-09-09 20:12 - 2015-07-10 21:06 - 00118272 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys 2015-09-09 20:11 - 2015-07-14 05:27 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzsync.exe 2015-09-09 20:10 - 2015-08-03 23:15 - 00074928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidapi.dll 2015-09-09 20:10 - 2015-08-03 23:15 - 00065600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appidapi.dll 2015-09-09 20:10 - 2015-08-01 16:22 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidsvc.dll ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-10-08 14:09 - 2015-08-07 22:20 - 00000000 ____D C:\Users\maddin 2015-10-08 14:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru 2015-10-08 13:58 - 2015-08-08 09:53 - 00001234 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job 2015-10-08 13:56 - 2014-11-14 17:38 - 02015514 _____ C:\WINDOWS\WindowsUpdate.log 2015-10-08 13:48 - 2015-08-23 19:14 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-10-08 13:47 - 2015-08-07 22:20 - 00000000 ____D C:\Users\maddin\AppData\Local\Pokki 2015-10-08 13:36 - 2013-08-22 16:46 - 00056415 _____ C:\WINDOWS\setupact.log 2015-10-08 12:52 - 2015-08-07 22:32 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3121378926-3824479896-3812363718-1001 2015-10-08 12:52 - 2015-08-07 22:27 - 00002282 _____ C:\Users\maddin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk 2015-10-08 12:47 - 2015-08-07 22:28 - 00002144 _____ C:\Users\maddin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk 2015-10-08 12:46 - 2015-08-08 08:58 - 00003244 _____ C:\WINDOWS\System32\Tasks\Pokki 2015-10-08 09:58 - 2015-08-08 09:53 - 00001230 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job 2015-10-08 09:04 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-10-08 05:13 - 2015-08-09 03:10 - 00000000 ___SD C:\WINDOWS\system32\GWX 2015-10-06 21:44 - 2015-08-08 20:36 - 00000000 ____D C:\Users\maddin\AppData\Roaming\vlc 2015-10-06 19:54 - 2015-08-10 22:12 - 00000000 ____D C:\Users\maddin\AppData\Roaming\Wise Registry Cleaner 2015-10-06 15:34 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-10-06 15:32 - 2015-08-09 03:10 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX 2015-10-06 15:00 - 2015-04-28 20:51 - 00000000 ____D C:\Users\maddin\Documents\RECHNUNGEN 2015-10-06 14:51 - 2015-08-09 18:36 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-10-06 14:51 - 2015-04-24 22:00 - 00000000 ___DO C:\Users\maddin\OneDrive 2015-10-04 21:37 - 2014-11-12 00:57 - 00764340 _____ C:\WINDOWS\system32\perfh007.dat 2015-10-04 21:37 - 2014-11-12 00:57 - 00159160 _____ C:\WINDOWS\system32\perfc007.dat 2015-10-04 21:37 - 2014-03-18 12:03 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-10-04 17:53 - 2015-08-08 20:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-10-04 17:46 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF 2015-10-04 17:42 - 2015-09-04 21:30 - 772335918 _____ C:\WINDOWS\MEMORY.DMP 2015-10-04 17:42 - 2015-09-04 21:30 - 00000000 ____D C:\WINDOWS\Minidump 2015-10-04 17:42 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-10-04 17:41 - 2014-03-18 11:54 - 00043498 _____ C:\WINDOWS\PFRO.log 2015-10-04 11:41 - 2015-08-08 21:09 - 00000000 ____D C:\WINDOWS\system32\MRT 2015-10-04 11:00 - 2015-08-08 09:53 - 00000000 ____D C:\Program Files (x86)\Dropbox 2015-10-02 13:05 - 2015-08-09 20:19 - 00000000 ____D C:\Users\maddin\AppData\Local\CrashDumps 2015-10-02 12:56 - 2015-08-16 18:22 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit 2015-10-02 12:55 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM 2015-10-02 12:54 - 2014-11-14 18:03 - 00902684 _____ C:\WINDOWS\SysWOW64\rootpa.e2e 2015-10-02 12:54 - 2014-11-14 17:58 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin 2015-10-02 12:54 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2015-09-28 20:02 - 2015-08-08 20:27 - 00001179 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-09-28 19:45 - 2015-09-05 17:18 - 00000000 ____D C:\Program Files (x86)\McAfee 2015-09-25 12:50 - 2014-07-14 17:40 - 00000000 ____D C:\ProgramData\McAfee 2015-09-23 10:09 - 2015-08-23 19:14 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2015-09-23 09:37 - 2015-04-24 14:55 - 00000000 ____D C:\Users\maddin\AppData\Local\Packages 2015-09-23 09:17 - 2013-08-22 16:44 - 00411880 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-09-15 03:18 - 2015-08-15 08:10 - 00812008 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-09-15 03:18 - 2015-08-15 08:10 - 00178152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-09-14 17:59 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache 2015-09-14 17:49 - 2015-08-09 20:10 - 00000000 ____D C:\Program Files (x86)\LibreOffice 4 2015-09-14 14:59 - 2014-11-14 18:19 - 00000000 ____D C:\ProgramData\Temp 2015-09-12 20:01 - 2015-08-06 14:19 - 00000000 ___HD C:\iExp3.tmp 2015-09-12 16:36 - 2015-08-08 10:02 - 00000000 ___RD C:\Users\maddin\Dropbox 2015-09-12 16:36 - 2015-04-26 10:04 - 00000000 ____D C:\Users\maddin\Desktop\SCANNER 2015-09-12 16:35 - 2015-08-08 09:53 - 00000000 ____D C:\Users\maddin\AppData\Local\Dropbox 2015-09-12 16:09 - 2015-08-07 22:37 - 00000000 __SHD C:\Users\maddin\AppData\Local\EmieUserList 2015-09-12 16:09 - 2015-08-07 22:37 - 00000000 __SHD C:\Users\maddin\AppData\Local\EmieSiteList 2015-09-11 23:09 - 2015-04-24 15:10 - 00000000 __SHD C:\Users\maddin\AppData\LocalLow\EmieUserList 2015-09-11 23:09 - 2015-04-24 15:10 - 00000000 __SHD C:\Users\maddin\AppData\LocalLow\EmieSiteList 2015-09-11 22:30 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\FxsTmp 2015-09-10 08:23 - 2015-09-07 22:22 - 00003000 _____ C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini 2015-09-10 08:23 - 2015-09-07 22:22 - 00003000 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini 2015-09-10 08:19 - 2014-03-18 11:45 - 00000000 ____D C:\Program Files\Windows Journal 2015-09-10 08:19 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-09-29 12:21 - 2015-09-29 12:21 - 0000036 _____ () C:\Users\maddin\AppData\Local\housecall.guid.cache 2014-11-14 18:01 - 2014-11-14 18:01 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Einige Dateien in TEMP: ==================== C:\Users\maddin\AppData\Local\Temp\McCSPInstall.dll C:\Users\maddin\AppData\Local\Temp\mccspuninstall.exe C:\Users\maddin\AppData\Local\Temp\octABCB.tmp.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-10-03 20:20 ==================== Ende von FRST.txt ============================ Geändert von voreifel (08.10.2015 um 15:12 Uhr) Grund: log von avira eingefügt |
| Themen zu Windows 8.1 ACER XC-115 EU Cleaner findet TR/Elenoocka.vvre und TR/Crypt.ZPACK.186038 |
| .dll, avira, defender, desktop, dnsapi.dll, entfernen, explorer, firefox, flash player, homepage, lavasofttcpservice64.dll, mozilla, mp3, prozesse, realtek, registry, scan, security, services.exe, siteadvisor, software, starten, super, svchost.exe, system, trojaner, windows, windowsapps, winlogon.exe |
Baum-Darstellung