Trojaner-Board
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Virenprogramme stürzen ab (https://www.trojaner-board.de/149127-virenprogramme-stuerzen-ab.html)

cosinus 04.02.2014 00:25
Hast schon JRT probiert? Wenn nicht, dann das zuerst
Bisher war die Reihenfolge MBAM, adwCleaner, JRT aber immer gut. Naja, manchmal gibt es Ausnahmen

baumus 04.02.2014 00:47
Hab jetzt JRT ausprobiert, war wohl der Schlüssel. Danach den adwcleaner...allerdings gibt es noch drei dateien die der adwcleaner nicht wegbekommt. Ich poste dir das logfile
Code:
# AdwCleaner v3.018 - Bericht erstellt am 04/02/2014 um 00:38:47
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Seppi - MICHAEL-PC
# Gestartet von : C:\Users\Seppi\Downloads\adwcleaner-3.018.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16506


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\trjms3ui.default\prefs.js ]


[ Datei : C:\Users\Seppi\AppData\Roaming\Mozilla\Firefox\Profiles\q79z9d8h.default\prefs.js ]


[ Datei : C:\Users\Michi\AppData\Roaming\Mozilla\Firefox\Profiles\zdk0d1rc.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [15954 octets] - [01/10/2013 10:17:55]
AdwCleaner[R10].txt - [2221 octets] - [04/02/2014 00:37:50]
AdwCleaner[R1].txt - [11199 octets] - [02/02/2014 23:10:20]
AdwCleaner[R2].txt - [11160 octets] - [03/02/2014 19:59:34]
AdwCleaner[R3].txt - [11326 octets] - [03/02/2014 21:37:38]
AdwCleaner[R4].txt - [10848 octets] - [03/02/2014 22:37:18]
AdwCleaner[R5].txt - [11036 octets] - [03/02/2014 23:29:04]
AdwCleaner[R6].txt - [11156 octets] - [03/02/2014 23:38:40]
AdwCleaner[R7].txt - [11208 octets] - [04/02/2014 00:03:03]
AdwCleaner[R8].txt - [11328 octets] - [04/02/2014 00:20:37]
AdwCleaner[R9].txt - [8748 octets] - [04/02/2014 00:32:22]
AdwCleaner[S0].txt - [16032 octets] - [01/10/2013 10:23:37]
AdwCleaner[S10].txt - [1610 octets] - [04/02/2014 00:38:47]
AdwCleaner[S1].txt - [480 octets] - [02/02/2014 23:14:03]
AdwCleaner[S2].txt - [359 octets] - [03/02/2014 20:00:59]
AdwCleaner[S3].txt - [365 octets] - [03/02/2014 21:39:05]
AdwCleaner[S4].txt - [365 octets] - [03/02/2014 22:38:33]
AdwCleaner[S5].txt - [433 octets] - [03/02/2014 23:29:38]
AdwCleaner[S6].txt - [433 octets] - [03/02/2014 23:40:30]
AdwCleaner[S7].txt - [365 octets] - [04/02/2014 00:03:41]
AdwCleaner[S8].txt - [365 octets] - [04/02/2014 00:21:17]
AdwCleaner[S9].txt - [8449 octets] - [04/02/2014 00:33:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S10].txt - [2203 octets] ##########

cosinus 04.02.2014 00:55
Log von JRT?

baumus 04.02.2014 01:00
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Seppi on 04.02.2014 at  0:28:24,71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113}



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installedbrowserextensions
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbarbackup
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbarlog
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.bandobjectattribute
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.dockingpanel
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbarbandobject
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.smartbardisplaystate
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.smartbarmenuform
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\searchthewebarp
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422592214}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466596614}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466596614}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\SaveSense
Successfully disinfected: [Shortcut] C:\Users\Seppi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Search.lnk
Successfully disinfected: [Shortcut] C:\Users\Seppi\AppData\Roaming\microsoft\windows\start menu\Programs\Search.lnk
Successfully repaired: [Shortcut] C:\Users\Seppi\desktop\Search.lnk



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Seppi\AppData\Roaming\opencandy"
Successfully deleted: [Folder] "C:\Users\Seppi\appdata\local\savesenselive"
Successfully deleted: [Folder] "C:\Users\Seppi\appdata\local\smartbar"
Successfully deleted: [Folder] "C:\Users\Seppi\appdata\locallow\smartbar"
Successfully deleted: [Folder] "C:\Program Files\qualitink"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uniblue"
Successfully deleted: [Folder] "C:\Users\Seppi\AppData\Roaming\microsoft\windows\start menu\programs\torntv.com"



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [File] C:\Users\Seppi\AppData\Roaming\mozilla\firefox\profiles\q79z9d8h.default\searchplugins\web search.xml
Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\\{184aa5e6-741d-464a-820e-94b3abc2f3b4}
Successfully deleted the following from C:\Users\Seppi\AppData\Roaming\mozilla\firefox\profiles\q79z9d8h.default\prefs.js

user_pref("browser.search.defaultenginename", "Web Search");
user_pref("browser.search.selectedEngine", "Web Search");
user_pref("extensions.crossrider.bic", "143586ce87e9f65a3ae38dba441dbe81");
user_pref("extensions.iminent.admin", false);
user_pref("extensions.iminent.aflt", "orgnl");
user_pref("extensions.iminent.appId", "{0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}");
user_pref("extensions.iminent.autoRvrt", "false");
user_pref("extensions.iminent.dfltLng", "");
user_pref("extensions.iminent.excTlbr", false);
user_pref("extensions.iminent.ffxUnstlRst", false);
user_pref("extensions.iminent.id", "30e8d1240000000000000022fb4c0df6");
user_pref("extensions.iminent.instlDay", "16028");
user_pref("extensions.iminent.instlRef", "");
user_pref("extensions.iminent.newTab", false);
user_pref("extensions.iminent.prdct", "iminent");
user_pref("extensions.iminent.prtnrId", "iminent");
user_pref("extensions.iminent.rvrt", "false");
user_pref("extensions.iminent.smplGrp", "none");
user_pref("extensions.iminent.tlbrId", "YBCPCSTIPO");
user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");
user_pref("extensions.iminent.vrsn", "1.8.26.8");
user_pref("extensions.iminent.vrsnTs", "1.8.26.81:28:14");
user_pref("extensions.iminent.vrsni", "1.8.26.8");
user_pref("iminent.enabledAds", "false");
Emptied folder: C:\Users\Seppi\AppData\Roaming\mozilla\firefox\profiles\q79z9d8h.default\minidumps [12 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.02.2014 at  0:31:08,83
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cosinus 04.02.2014 01:03
Malwarebytes....JETZT :D

baumus 04.02.2014 01:05
Habi...log...1 datei...bei der stürzt er leider aber auch ab


Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.02.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Seppi :: MICHAEL-PC [administrator]

04.02.2014 00:49:15
MBAM-log-2014-02-04 (01-02-20).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 305884
Time elapsed: 12 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Users\Seppi\AppData\Local\Plus-HD-4.8 (PUP.Optional.PlusHD.A) -> No action taken.

Files Detected: 0
(No malicious items detected)

(end)

cosinus 04.02.2014 01:42
Zitat:
Database version: v2014.02.02.05
möööpp....du hast mbam vorher nicht aktualisiert :D

baumus 04.02.2014 02:02
aaaaber auch mit neuer Version steigt er leider aus...
Weißt du was das ist?



Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.04.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Seppi :: MICHAEL-PC [administrator]

04.02.2014 01:45:51
MBAM-log-2014-02-04 (01-59-36).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 305788
Time elapsed: 13 minute(s), 35 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Users\Seppi\AppData\Local\Plus-HD-4.8 (PUP.Optional.PlusHD.A) -> No action taken.

Files Detected: 0
(No malicious items detected)

(end)

cosinus 04.02.2014 02:07
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\Users\Seppi\AppData\Local\Plus-HD-4.8

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


baumus 04.02.2014 02:15
oki...

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 01-02-2014 03
Ran by Seppi at 2014-02-04 02:14:18 Run:1
Running from C:\Users\Seppi\Downloads
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\Seppi\AppData\Local\Plus-HD-4.8
*****************

C:\Users\Seppi\AppData\Local\Plus-HD-4.8 => Moved successfully.

==== End of Fixlog ====

cosinus 04.02.2014 02:58
Malwarebytes Anti-Malware wiederholen

baumus 04.02.2014 14:07
Hello, hab jetzt malwarebytes wiederholt...und er findet nichts mehr , dennoch findet der adwcleaner drei Dateien, welche er nicht löschen kann. Komischerweise haben die auch kein Häkchen am rand zu an,- oder abklicken.

Log von malwarebytes :
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.04.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Seppi :: MICHAEL-PC [administrator]

04.02.2014 13:42:49
mbam-log-2014-02-04 (13-42-49).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 306338
Time elapsed: 15 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


und dann noch das adwcleaner log :
Code:
# AdwCleaner v3.018 - Bericht erstellt am 04/02/2014 um 14:06:12
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Seppi - MICHAEL-PC
# Gestartet von : C:\Users\Seppi\Downloads\adwcleaner-3.018.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16506


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\trjms3ui.default\prefs.js ]


[ Datei : C:\Users\Seppi\AppData\Roaming\Mozilla\Firefox\Profiles\q79z9d8h.default\prefs.js ]


[ Datei : C:\Users\Michi\AppData\Roaming\Mozilla\Firefox\Profiles\zdk0d1rc.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [15954 octets] - [01/10/2013 10:17:55]
AdwCleaner[R10].txt - [2221 octets] - [04/02/2014 00:37:50]
AdwCleaner[R11].txt - [2344 octets] - [04/02/2014 00:43:03]
AdwCleaner[R12].txt - [2405 octets] - [04/02/2014 01:14:34]
AdwCleaner[R13].txt - [2527 octets] - [04/02/2014 01:18:44]
AdwCleaner[R14].txt - [2588 octets] - [04/02/2014 13:59:58]
AdwCleaner[R15].txt - [1244 octets] - [04/02/2014 14:06:12]
AdwCleaner[R1].txt - [11199 octets] - [02/02/2014 23:10:20]
AdwCleaner[R2].txt - [11160 octets] - [03/02/2014 19:59:34]
AdwCleaner[R3].txt - [11326 octets] - [03/02/2014 21:37:38]
AdwCleaner[R4].txt - [10848 octets] - [03/02/2014 22:37:18]
AdwCleaner[R5].txt - [11036 octets] - [03/02/2014 23:29:04]
AdwCleaner[R6].txt - [11156 octets] - [03/02/2014 23:38:40]
AdwCleaner[R7].txt - [11208 octets] - [04/02/2014 00:03:03]
AdwCleaner[R8].txt - [11328 octets] - [04/02/2014 00:20:37]
AdwCleaner[R9].txt - [8748 octets] - [04/02/2014 00:32:22]
AdwCleaner[S0].txt - [16032 octets] - [01/10/2013 10:23:37]
AdwCleaner[S10].txt - [2284 octets] - [04/02/2014 00:38:47]
AdwCleaner[S11].txt - [2467 octets] - [04/02/2014 01:15:24]
AdwCleaner[S1].txt - [480 octets] - [02/02/2014 23:14:03]
AdwCleaner[S2].txt - [359 octets] - [03/02/2014 20:00:59]
AdwCleaner[S3].txt - [365 octets] - [03/02/2014 21:39:05]
AdwCleaner[S4].txt - [365 octets] - [03/02/2014 22:38:33]
AdwCleaner[S5].txt - [433 octets] - [03/02/2014 23:29:38]
AdwCleaner[S6].txt - [433 octets] - [03/02/2014 23:40:30]
AdwCleaner[S7].txt - [365 octets] - [04/02/2014 00:03:41]
AdwCleaner[S8].txt - [365 octets] - [04/02/2014 00:21:17]
AdwCleaner[S9].txt - [8449 octets] - [04/02/2014 00:33:09]

########## EOF - C:\AdwCleaner\AdwCleaner[R15].txt - [2568 octets] ##########

cosinus 04.02.2014 15:42
Frisches FRST Log bitte :D

baumus 04.02.2014 15:54
here you go...


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-02-2014 03
Ran by Seppi (administrator) on MICHAEL-PC on 04-02-2014 15:53:01
Running from C:\Users\Seppi\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Creative Technology Ltd.) C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Team H2O) C:\Program Files\Syncrosoft\POS\H2O\cledx.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_11_9_900_170_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Dell Webcam Central] - C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe [442536 2008-11-11] (Creative Technology Ltd.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1983816 2009-03-24] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-03-18] (CANON INC.)
HKLM\...\Run: [Malwarebytes Anti-Malware (reboot)] - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [887432 2013-04-04] (Malwarebytes Corporation)
HKLM\...\Run: [H2O] - C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe [385024 2005-10-22] (Team H2O)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
HKU\.DEFAULT\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3882312 2008-12-03] (Microsoft Corporation)
HKU\S-1-5-21-1390377413-2575980544-3326841737-1002\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1390377413-2575980544-3326841737-1002\...\Winlogon: [Shell] Explorer.exe [2926592 2009-04-11] (Microsoft Corporation) <==== ATTENTION
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Michi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Seppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540104} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Seppi\AppData\Roaming\Mozilla\Firefox\Profiles\q79z9d8h.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX OVS Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Seppi\AppData\Roaming\Mozilla\Firefox\Profiles\q79z9d8h.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2013-08-03]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-01-07]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-01-07]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-01-07]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [81920 2009-03-20] (Andrea Electronics Corporation)
R2 Akamai; c:\program files\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528616 2010-03-23] (Cisco Systems, Inc.)
R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation)
S3 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-02-10] ()
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 sprtsvc_DellSupportCenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2009-01-30] (SupportSoft, Inc.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe [254042 2009-03-20] (IDT, Inc.)

==================== Drivers (Whitelisted) ====================

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)
R2 Aspi32; C:\Windows\system32\Drivers\Aspi32.sys [25244 1999-09-10] (Adaptec)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 CLEDX; C:\Windows\System32\DRIVERS\cledx.sys [33792 2005-05-09] (Team H2O)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2010-03-23] (Cisco Systems, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [26024 2009-12-17] (Elaborate Bytes AG)
R3 OA008Ufd; C:\Windows\System32\DRIVERS\OA008Ufd.sys [133472 2009-02-10] (Creative Technology Ltd.)
R3 OA008Vid; C:\Windows\System32\DRIVERS\OA008Vid.sys [271616 2009-02-10] (Creative Technology Ltd.)
S3 Ph3xIB32; C:\Windows\System32\DRIVERS\Ph3xIB32.sys [1083520 2006-11-02] (Philips Semiconductors GmbH)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-15] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Seppi\AppData\Local\Temp\catchme.sys [x]
U1 d3dsbe; \??\C:\Windows\system32\drivers\d3dsbe.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S2 Nsynas32; No ImagePath
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S2 Parclass; \SystemRoot\System32\Drivers\Parclass.sys [x]
S3 PCD5SRVC{3F6A8B78-EC003E00-05040104}; \??\C:\PROGRA~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [x]
S3 StarOpen; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-04 15:53 - 2014-02-04 15:53 - 00018278 _____ () C:\Users\Seppi\Downloads\FRST.txt
2014-02-04 00:31 - 2014-02-04 00:31 - 00005417 _____ () C:\Users\Seppi\Desktop\JRT.txt
2014-02-04 00:28 - 2014-02-04 00:28 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 22:24 - 2014-02-03 22:24 - 00009060 _____ () C:\Users\Seppi\Desktop\ComboFix.zip
2014-02-03 22:04 - 2014-02-03 22:04 - 00124008 _____ () C:\ComboFix.txt
2014-02-03 21:50 - 2014-02-03 22:04 - 00000000 ____D () C:\ComboFix
2014-02-03 21:49 - 2014-02-03 22:04 - 00000000 ____D () C:\Qoobox
2014-02-03 21:47 - 2014-02-03 21:49 - 05179684 ____R (Swearware) C:\Users\Seppi\Desktop\ComboFix.exe
2014-02-03 21:37 - 2014-02-03 21:37 - 01166132 _____ () C:\Users\Seppi\Downloads\adwcleaner-3.018.exe
2014-02-03 00:59 - 2014-02-03 13:03 - 00000000 ____D () C:\Users\Seppi\Desktop\mbar
2014-02-03 00:59 - 2014-02-03 02:55 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-03 00:57 - 2014-02-03 00:58 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Seppi\Desktop\mbar-1.07.0.1009.exe
2014-02-03 00:01 - 2014-02-04 15:53 - 00000000 ____D () C:\FRST
2014-02-02 23:49 - 2014-02-02 23:50 - 01137152 _____ (Farbar) C:\Users\Seppi\Downloads\FRST.exe
2014-02-02 23:42 - 2014-02-02 23:42 - 00000000 _____ () C:\Users\Seppi\defogger_reenable
2014-02-01 20:23 - 2014-02-01 20:23 - 00139616 _____ () C:\Windows\Minidump\Mini020114-01.dmp
2014-01-13 21:57 - 2014-01-13 21:58 - 00139616 _____ () C:\Windows\Minidump\Mini011314-01.dmp
2014-01-10 20:35 - 2014-01-10 20:36 - 00139616 _____ () C:\Windows\Minidump\Mini011014-01.dmp
2014-01-08 20:17 - 2014-01-08 20:17 - 00000868 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-08 20:17 - 2014-01-08 20:17 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-01-08 20:17 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-08 20:13 - 2014-01-08 20:16 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Seppi\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-07 23:48 - 2014-01-07 23:48 - 00000000 ____D () C:\Users\Seppi\AppData\Roaming\TuneUp Software
2014-01-07 23:40 - 2014-01-07 23:49 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-01-07 23:40 - 2014-01-07 23:41 - 34008992 _____ (DVDVideoSoft Ltd. ) C:\Users\Seppi\Downloads\FreeYouTubeToMP3Converter-3.12.20.1230.exe
2014-01-07 23:40 - 2014-01-07 23:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-01-07 23:36 - 2014-02-04 00:31 - 00001797 _____ () C:\Users\Seppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-01-07 23:36 - 2014-02-04 00:31 - 00001767 _____ () C:\Users\Seppi\Desktop\Search.lnk
2014-01-07 23:34 - 2014-01-08 20:03 - 00000000 ____D () C:\Users\Seppi\AppData\Roaming\DVDVideoSoft
2014-01-07 23:32 - 2014-01-07 23:33 - 32244744 _____ (DVDVideoSoft Ltd. ) C:\Users\Seppi\Downloads\FreeYouTubeDownload-3.2.20.1230.exe
2014-01-07 21:29 - 2014-01-29 22:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-02-04 15:53 - 2014-02-04 15:53 - 00018278 _____ () C:\Users\Seppi\Downloads\FRST.txt
2014-02-04 15:53 - 2014-02-03 00:01 - 00000000 ____D () C:\FRST
2014-02-04 15:51 - 2011-03-21 21:48 - 00000000 ____D () C:\Users\Seppi\AppData\Roaming\Skype
2014-02-04 15:40 - 2009-12-14 00:11 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-04 14:59 - 2012-06-18 21:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-04 14:55 - 2012-02-25 01:14 - 01551103 _____ () C:\Windows\WindowsUpdate.log
2014-02-04 14:21 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-04 14:21 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-04 14:06 - 2013-10-01 10:17 - 00000000 ____D () C:\AdwCleaner
2014-02-04 12:40 - 2009-12-14 00:11 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-04 12:21 - 2010-08-27 14:45 - 00000000 ____D () C:\Program Files\Common Files\Akamai
2014-02-04 12:21 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-04 02:29 - 2006-11-02 14:01 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-04 00:31 - 2014-02-04 00:31 - 00005417 _____ () C:\Users\Seppi\Desktop\JRT.txt
2014-02-04 00:31 - 2014-01-07 23:36 - 00001797 _____ () C:\Users\Seppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-02-04 00:31 - 2014-01-07 23:36 - 00001767 _____ () C:\Users\Seppi\Desktop\Search.lnk
2014-02-04 00:28 - 2014-02-04 00:28 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 23:31 - 2012-12-04 21:34 - 00039722 _____ () C:\Windows\PFRO.log
2014-02-03 22:43 - 2012-04-15 19:21 - 00002339 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-02-03 22:24 - 2014-02-03 22:24 - 00009060 _____ () C:\Users\Seppi\Desktop\ComboFix.zip
2014-02-03 22:04 - 2014-02-03 22:04 - 00124008 _____ () C:\ComboFix.txt
2014-02-03 22:04 - 2014-02-03 21:50 - 00000000 ____D () C:\ComboFix
2014-02-03 22:04 - 2014-02-03 21:49 - 00000000 ____D () C:\Qoobox
2014-02-03 22:02 - 2006-11-02 11:23 - 00000385 _____ () C:\Windows\system.ini
2014-02-03 22:00 - 2011-02-12 16:36 - 00000000 ____D () C:\Users\Seppi
2014-02-03 22:00 - 2009-06-03 22:44 - 00000000 ____D () C:\Users\Michael
2014-02-03 21:49 - 2014-02-03 21:47 - 05179684 ____R (Swearware) C:\Users\Seppi\Desktop\ComboFix.exe
2014-02-03 21:37 - 2014-02-03 21:37 - 01166132 _____ () C:\Users\Seppi\Downloads\adwcleaner-3.018.exe
2014-02-03 13:03 - 2014-02-03 00:59 - 00000000 ____D () C:\Users\Seppi\Desktop\mbar
2014-02-03 13:03 - 2010-12-08 17:20 - 00001022 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-02-03 02:55 - 2014-02-03 00:59 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-03 00:58 - 2014-02-03 00:57 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Seppi\Desktop\mbar-1.07.0.1009.exe
2014-02-02 23:50 - 2014-02-02 23:49 - 01137152 _____ (Farbar) C:\Users\Seppi\Downloads\FRST.exe
2014-02-02 23:42 - 2014-02-02 23:42 - 00000000 _____ () C:\Users\Seppi\defogger_reenable
2014-02-01 20:23 - 2014-02-01 20:23 - 00139616 _____ () C:\Windows\Minidump\Mini020114-01.dmp
2014-02-01 20:23 - 2013-07-22 11:15 - 299486590 _____ () C:\Windows\MEMORY.DMP
2014-02-01 20:23 - 2010-03-26 12:38 - 00000000 ____D () C:\Windows\Minidump
2014-01-30 20:00 - 2013-08-03 12:03 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-01-29 22:18 - 2014-01-07 21:29 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-01-29 22:18 - 2013-08-03 12:03 - 00000808 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-13 21:58 - 2014-01-13 21:57 - 00139616 _____ () C:\Windows\Minidump\Mini011314-01.dmp
2014-01-10 20:36 - 2014-01-10 20:35 - 00139616 _____ () C:\Windows\Minidump\Mini011014-01.dmp
2014-01-08 20:17 - 2014-01-08 20:17 - 00000868 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-08 20:17 - 2014-01-08 20:17 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-01-08 20:16 - 2014-01-08 20:13 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Seppi\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-08 20:03 - 2014-01-07 23:34 - 00000000 ____D () C:\Users\Seppi\AppData\Roaming\DVDVideoSoft
2014-01-08 00:43 - 2011-10-06 20:14 - 00000000 ____D () C:\Users\Seppi\AppData\Roaming\Audacity
2014-01-08 00:33 - 2013-07-08 21:40 - 00000000 ____D () C:\Users\Seppi\Desktop\Neuer Ordner
2014-01-07 23:49 - 2014-01-07 23:40 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-01-07 23:48 - 2014-01-07 23:48 - 00000000 ____D () C:\Users\Seppi\AppData\Roaming\TuneUp Software
2014-01-07 23:41 - 2014-01-07 23:40 - 34008992 _____ (DVDVideoSoft Ltd. ) C:\Users\Seppi\Downloads\FreeYouTubeToMP3Converter-3.12.20.1230.exe
2014-01-07 23:40 - 2014-01-07 23:40 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-01-07 23:33 - 2014-01-07 23:32 - 32244744 _____ (DVDVideoSoft Ltd. ) C:\Users\Seppi\Downloads\FreeYouTubeDownload-3.2.20.1230.exe
2014-01-07 22:25 - 2011-03-23 14:07 - 00035840 _____ () C:\Users\Seppi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Files to move or delete:
====================
C:\Users\Michael\AppData\Roaming\desktop.ini
C:\Users\Seppi\CTX.DAT


Some content of TEMP:
====================
C:\Users\Seppi\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-04 12:27

==================== End Of Log ============================
--- --- ---

cosinus 04.02.2014 16:24
Kontrollscan bitte


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Alle Zeitangaben in WEZ +1. Es ist jetzt 16:57 Uhr.
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131