Win 8 - Versuchte Registryänderung
Ok, habe seid einigen Tagen massive Virenprobleme (gehabt), auf meinem Mainacc haben sich immer mehr Programme im Hintergrund geöffnet, danach hat Avast im Sekundentakt Schadsoftware geblockt, und ein paar Stunden später ging alle 2 Sek die Benutzerkontensteuerung an und wollte Adminrechte für die Registry (welche ich nicht erteilt habe). Main Mainaccount war damit nicht mehr benutztbar. Avast hat daraufhin einen Scan noch vor dem Systemstart durchgeführt.
Alle weiteren Scans habe ich auf dem Gastkonto durchgeführt:
Zunächst ein MBAM Scan: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 28.12.2014
Scan Time: 13:42:59
Logfile: mbam scan.txt
Administrator: Yes
Version: 2.00.4.1028
Malware Database: v2014.12.28.06
Rootkit Database: v2014.12.23.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 8.1
CPU: x64
File System: NTFS
User: janeisklar
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 376893
Time Elapsed: 17 min, 59 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 10
PUP.Optional.Snapdo.T, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, Quarantined, [092d7eeabbc11026ae00ff18857ec33d],
PUP.Optional.Snapdo.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, Quarantined, [092d7eeabbc11026ae00ff18857ec33d],
Trojan.FakeMS.ED, HKLM\SOFTWARE\CLASSES\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF}, Quarantined, [f3432345740860d64c0847aa50b152ae],
PUP.Optional.CrossRider.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [0432e187bebefd39a74c0ac0ba4a6799],
PUP.Optional.GeForce.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Ge-Force, Quarantined, [df57a7c1ea9285b1c1e8d106af552ad6],
PUP.Optional.HQVideo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HQ-Video-Pro-2.1cV21.12, Quarantined, [1a1ce78189f3023491b2914b0ff51fe1],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [ad899dcb611bd85eb340a228d82c827e],
PUP.Optional.ShoppingHelper.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR, Quarantined, [ba7c5315413bfb3baf5bdafe9f65c63a],
PUP.Optional.ShopperPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}, Quarantined, [72c44d1b3b412d095109c8beb64f55ab],
PUP.Optional.ShopperPro, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}, Quarantined, [72c44d1b3b412d095109c8beb64f55ab],
Registry Values: 3
PUP.Optional.SmartBar, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, Quarantined, [3afcd296720a9a9ce13d165ab44f3ec2]
PUP.Optional.SmartBar, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, Quarantined, [f73f5c0c403cb08606183a3609faed13]
PUP.Optional.ShoppingHelper.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR|publisher, ShoppingHelper, Quarantined, [ba7c5315413bfb3baf5bdafe9f65c63a]
Registry Data: 7
PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuY4,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuY4,&q={searchTerms}),Replaced,[c17513550775d5619170690b82837f81]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[d75f75f33b4141f5798ba0d4da2b07f9]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWkNkWzOavfK1c5h1F1blx0g4YALiwok3ZMudnEKWQv-VhUsioWmKoJFtatiF2uE,, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWkNkWzOavfK1c5h1F1blx0g4YALiwok3ZMudnEKWQv-VhUsioWmKoJFtatiF2uE,),Replaced,[33034a1ef884b1854fb6cca8f70e51af]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[2f071e4a76061620a85b066e28ddb050]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[9f9720485f1dee48d92df57f9570cf31]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[3105da8ede9e290d36d1b1c359ac827e]
PUP.Optional.SnapDo.A, HKU\S-1-5-21-2855763909-2318779563-1536155455-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZLLx3LpAeVW-lRGGSHpxmTbfKJHlnyK_aDwNHQOCwyOLJch7wqhi-1tfoQyLurXllxetPJfPUaBY3WvmpzdedmgeRHD-ERwsmikGWk8Tgzhg_CK0gWdVnWJQVN5biEK9uh0A59wDL7nNx5KZsM9jTataj7CahsOHuYk,&q={searchTerms}),Replaced,[4ee8491f5c20d264ad55db990afb03fd]
Folders: 0
(No malicious items detected)
Files: 8
Trojan.Ransom.ED, C:\ProgramData\EAF79594B.cpp, Quarantined, [42f4b1b7acd085b1497023dace3323dd],
Trojan.Agent.ED, C:\ProgramData\Windows Genuine Advantage\{6BCC7DAA-0F61-4F4C-8BFA-38F32EA8636B}\powercpl31.dll, Quarantined, [96a037311a62270f6e7b1fe0b34e966a],
Trojan.FakeMS.ED, C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\d3d10core.dll, Delete-on-Reboot, [f3432345740860d64c0847aa50b152ae],
PUP.Optional.HQVideo.A, C:\Users\janeisklar\AppData\Roaming\VIZGDEC.exe, Quarantined, [6fc7610788f4a59162488c2530d5956b],
PUP.Optional.Sense.A, C:\Program Files (x86)\Sense\Sense-bho.dll, Quarantined, [88ae491fe09cc76fe15e4525d031eb15],
Trojan.Ransom.ED, C:\Users\janeisklar\AppData\Local\Temp\bZKO.dll, Quarantined, [0c2a0e5a82fa6fc7e9d0af4e2fd24bb5],
PUP.Optional.WebSearch.A, C:\Users\janeisklar\AppData\Roaming\Mozilla\Firefox\Profiles\kmpgplgm.default\searchplugins\Web Search.xml, Quarantined, [55e1e68229534de96c8e2a6cc83bdb25],
PUP.Optional.CrossRider.A, C:\Users\janeisklar\AppData\Roaming\Mozilla\Firefox\Profiles\kmpgplgm.default\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "14a6d07cb674296d5c7cffb75ba263da");), Replaced,[fe3842260f6d83b3ca4349700afb619f]
Physical Sectors: 0
(No malicious items detected)
(end)
Danach bin ich nach Forenanleitung vorgegangen:
Defogger: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:45 on 28/12/2014 (janeisklar)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-12-2014
Ran by Gast (ATTENTION: The logged in user is not administrator) on PIZZAPLANET on 28-12-2014 14:11:02
Running from C:\Users\Gast\Downloads
Loaded Profile: Gast (Available profiles: janeisklar & Gast)
Platform: Windows 8.1 Connected (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Pokki) C:\Users\Gast\AppData\Local\Pokki\Engine\StartMenuIndexer.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(NOX) C:\Program Files (x86)\Ozone Gaming\Ozone Radon\Ozone_Radon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Pokki) C:\Users\Gast\AppData\Local\Pokki\Engine\HostAppService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Pokki) C:\Users\Gast\AppData\Local\Pokki\Engine\HostAppService.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1368792 2013-11-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-03-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LVT] => C:\Program Files\Lenovo\LVT\LJYZ.exe [886112 2011-11-24] (Lenovo)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [585536 2014-11-03] (Razer Inc.)
HKLM-x32\...\Run: [Ozone Radon Gaming Mouse] => C:\Program Files (x86)\Ozone Gaming\Ozone Radon\Ozone_Radon.exe [25473024 2011-09-28] (NOX)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3838800 2014-12-13] (LogMeIn Inc.)
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-12-28] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\...\Run: [Pokki] => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60267;https=127.0.0.1:60267
ProxyEnable: [S-1-5-21-2855763909-2318779563-1536155455-501] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-2855763909-2318779563-1536155455-501] => http=127.0.0.1:60267;https=127.0.0.1:60267
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2855763909-2318779563-1536155455-501\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKU\S-1-5-21-2855763909-2318779563-1536155455-501 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2855763909-2318779563-1536155455-501 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-28]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-28]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
Locked "EventLog" service could not be unlocked. <===== ATTENTION
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-03-25] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-28] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-28] (Avast Software)
S4 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2370240 2014-11-27] (Comodo Security Solutions, Inc.)
S4 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-11-21] (LENOVO INCORPORATED.)
R2 lmhosts; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-12-02] (LogMeIn, Inc.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 NlaSvc; C:\Windows\System32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [183488 2014-10-31] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 tbaseprovisioning; C:\Windows\SysWOW64\tbaseprovisioning.exe [51712 2014-04-16] (Advanced Micro Devices, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 amdkmcsp; C:\Windows\system32\DRIVERS\amdkmcsp.sys [85704 2014-04-16] (Advanced Micro Devices, Inc. )
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2014-04-16] (Advanced Micro Devices, Inc.)
R0 amdpsp; C:\Windows\System32\DRIVERS\amdpsp.sys [230088 2014-04-16] (Advanced Micro Devices, Inc. )
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-28] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-28] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-28] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-28] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-28] ()
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45112 2014-12-13] (LogMeIn Inc.)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-28] (Malwarebytes Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 rzendpt; C:\Windows\System32\drivers\rzendpt.sys [39592 2014-09-05] (Razer Inc)
R2 rzpmgrk; C:\WINDOWS\system32\drivers\rzpmgrk.sys [37184 2014-10-31] (Razer, Inc.)
R2 rzpnk; C:\WINDOWS\system32\drivers\rzpnk.sys [129600 2014-10-23] (Razer, Inc.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-28] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-28 13:39 - 2014-12-28 13:42 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-28 13:39 - 2014-12-28 13:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-28 13:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-12-28 13:39 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-12-28 13:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-12-28 13:18 - 2014-12-28 13:19 - 00000000 ____D () C:\Users\Gast
2014-12-28 13:12 - 2014-12-28 13:12 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-12-12-13.060-aswFe.exe-4244.log
2014-12-28 13:04 - 2014-12-28 13:12 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-12-04-46.021-aswFe.exe-4964.log
2014-12-28 13:04 - 2014-12-28 13:07 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-28 13:04 - 2014-12-28 13:04 - 00000197 _____ () C:\WINDOWS\system32\2014-12-28-12-04-42.094-AvastVBoxSVC.exe-1504.log
2014-12-28 13:04 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2014-12-28 05:45 - 2014-12-28 14:02 - 00006102 _____ () C:\WINDOWS\PFRO.log
2014-12-28 02:48 - 2014-10-30 12:25 - 00275080 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-12-28 02:23 - 2014-12-28 02:23 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-01-23-41.042-aswFe.exe-8084.log
2014-12-28 02:11 - 2014-12-28 02:23 - 00000247 _____ () C:\WINDOWS\system32\2014-12-28-01-11-56.015-aswFe.exe-4244.log
2014-12-28 02:10 - 2014-12-28 02:10 - 00000197 _____ () C:\WINDOWS\system32\2014-12-28-01-10-36.020-AvastVBoxSVC.exe-8052.log
2014-12-28 01:23 - 2014-12-28 01:23 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-12-28 01:23 - 2014-12-28 01:23 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-12-28 01:10 - 2014-12-28 01:11 - 00000000 ____D () C:\WINDOWS\SysWOW64\vbox
2014-12-28 01:10 - 2014-12-28 01:11 - 00000000 ____D () C:\WINDOWS\system32\vbox
2014-12-28 01:04 - 2014-12-28 01:29 - 00000000 ____D () C:\Program Files (x86)\Google
2014-12-28 01:03 - 2014-12-28 01:23 - 01050432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00083280 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswmonflt.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-12-28 01:03 - 2014-12-28 01:23 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-12-28 01:03 - 2014-12-28 01:03 - 00000000 ____D () C:\Program Files\LockHunter
2014-12-28 01:02 - 2014-12-28 01:02 - 00000000 ____D () C:\Program Files\AVAST Software
2014-12-27 22:57 - 2014-12-27 22:57 - 00057096 _____ (COMODO CA Limited) C:\WINDOWS\system32\certsentry.dll
2014-12-27 22:57 - 2014-12-27 22:57 - 00048392 _____ (COMODO CA Limited) C:\WINDOWS\SysWOW64\certsentry.dll
2014-12-27 22:57 - 2014-12-27 22:57 - 00000000 ____D () C:\Program Files (x86)\Comodo
2014-12-27 22:56 - 2014-12-27 22:56 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc71.dll
2014-12-27 20:16 - 2014-12-28 14:07 - 00194824 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-21 15:47 - 2014-12-21 15:47 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-21 15:07 - 2014-12-21 15:07 - 00000000 _____ () C:\autoexec.bat
2014-12-21 14:23 - 2014-12-21 14:23 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-21 14:22 - 2014-12-28 14:01 - 00000000 ____D () C:\Program Files (x86)\Sense
2014-12-21 14:19 - 2014-12-21 15:07 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-12-20 17:09 - 2014-12-20 17:09 - 00000000 ____D () C:\Program Files (x86)\Helden-Software
2014-12-16 08:27 - 2014-12-16 08:27 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-12-13 17:01 - 2014-12-13 17:01 - 00045112 ____H (LogMeIn Inc.) C:\WINDOWS\system32\Drivers\Hamdrv.sys
2014-12-13 13:45 - 2014-12-13 13:45 - 00066728 _____ (Eugene V. Muzychenko) C:\WINDOWS\system32\Drivers\vrtaucbl.sys
2014-12-13 13:45 - 2014-12-13 13:45 - 00000000 ____D () C:\Program Files\Virtual Audio Cable
2014-12-13 13:42 - 2014-12-13 13:42 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-12-09 19:41 - 2014-12-09 19:41 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-12-09 14:00 - 2014-12-09 14:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-08 22:54 - 2014-12-08 22:55 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-12-04 07:53 - 2014-12-04 07:52 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-12-04 07:52 - 2014-12-04 07:52 - 00000000 ____D () C:\Program Files (x86)\Java
2014-12-01 11:21 - 2014-12-01 11:29 - 00000000 ____D () C:\rads
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-28 14:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-28 14:04 - 2014-08-14 13:10 - 01948257 _____ () C:\WINDOWS\SysWOW64\rootpa.e2e
2014-12-28 14:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\InputMethod
2014-12-28 14:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-12-28 13:45 - 2014-11-15 18:09 - 00000000 ____D () C:\Users\janeisklar
2014-12-28 11:46 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-28 05:46 - 2013-08-22 15:44 - 00374456 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-28 00:45 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\migwiz
2014-12-21 15:51 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-12-21 15:51 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2014-12-21 15:48 - 2014-11-16 20:17 - 00000000 ____D () C:\WINDOWS\Minidump
2014-12-21 15:48 - 2014-04-02 18:34 - 00000000 ____D () C:\WINDOWS\Panther
2014-12-18 11:55 - 2014-08-14 22:50 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-18 11:55 - 2014-08-14 22:50 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-18 11:55 - 2014-03-18 10:53 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-10 07:55 - 2014-11-15 18:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-08 15:14 - 2014-11-16 08:42 - 00000000 ____D () C:\mukke
2014-12-07 23:52 - 2014-11-16 13:22 - 00000000 ____D () C:\Program Files (x86)\EA Games
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
mit addition: Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-12-2014
Ran by Gast at 2014-12-28 13:49:55
Running from C:\Users\Gast\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{A0EE5DB1-8E1F-7BB2-6734-9CDC5E8DF0DD}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
BEACON (HKLM-x32\...\{259BF8E7-28DB-461F-8D7F-7B6E267D2502}_is1) (Version: 1.4.0509.0 - Lenovo Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 36.1.1.21 - Comodo)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version: - CyberGhost S.R.L.)
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
Dependency Package Update (x32 Version: 1.6.32.00 - Lenovo Group Limited) Hidden
Driver & Application Installation (HKLM-x32\...\{BFECCF2A-F094-4066-8BFA-29CCBB7F6602}) (Version: 6.13.0621 - Lenovo)
foobar2000 v1.3.5 (HKLM-x32\...\foobar2000) (Version: 1.3.5 - Peter Pawlowski)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Lenovo Assistant (HKLM-x32\...\{B2DE4F30-B8C7-49C0-85B9-2F37A5290F00}) (Version: 2.0.0.29 - Lenovo)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.32.00 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.7408 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.7408 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.1901 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.1901 - CyberLink Corp.) Hidden
Lenovo Web Start (HKU\S-1-5-21-2855763909-2318779563-1536155455-501\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.1.52728 - Pokki)
Lenovo Web Start (HKU\S-1-5-21-2855763909-2318779563-1536155455-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.1.52728 - Pokki)
LockHunter 3.1, 32/64 bit (HKLM\...\LockHunter_is1) (Version: - Crystal Rich Ltd)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.291 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.291 - LogMeIn, Inc.) Hidden
LVT (HKLM-x32\...\{9E3469A6-443A-452C-BF44-8D7CE3A9A7E2}) (Version: 5.00.0914 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
MSXML4 Parser (HKLM-x32\...\{01501EBA-EC35-4F9F-8889-3BE346E5DA13}) (Version: 1.0.0 - Microsoft Game Studios)
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
NVIDIA PhysX v8.10.17 (HKLM-x32\...\{E4D15328-8C89-484B-B9AA-F5BE9EA6D01C}) (Version: 8.10.17 - NVIDIA Corporation)
Ozone Radon (HKLM-x32\...\{B50AB875-64A2-4D12-BB48-B15611B48CE0}) (Version: 1.0.0 - Ozone Gaming)
PSP Application (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.18.23036 - Razer Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39054 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.18.621.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7106 - Realtek Semiconductor Corp.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Startmenü (HKU\S-1-5-21-2855763909-2318779563-1536155455-501\...\Pokki) (Version: 0.268.2.183 - Pokki)
Startmenü (HKU\S-1-5-21-2855763909-2318779563-1536155455-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Pokki) (Version: 0.268.2.183 - Pokki)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Virtual Audio Cable 4.10 (HKLM\...\Virtual Audio Cable 4.10) (Version: - )
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list restore points.
Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
==================== Loaded Modules (whitelisted) =============
2014-03-25 09:23 - 2014-03-25 09:23 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Windows:nlsPreferences
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: CGVPNCliService => 2
MSCONFIG\Services: Lenovo System Agent Service => 2
MSCONFIG\Services: MpsSvc => 2
HKLM\...\StartupApproved\StartupFolder: => "FamilySafetyGuide.lnk"
HKLM\...\StartupApproved\Run32: => "CLMLServer"
HKLM\...\StartupApproved\Run32: => "LVT"
HKLM\...\StartupApproved\Run32: => "jmekey"
HKLM\...\StartupApproved\Run32: => "mcpltui_exe"
HKLM\...\StartupApproved\Run32: => "UpdateP2GoShortCut"
HKLM\...\StartupApproved\Run32: => "jmesoft"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "SPDriver"
HKLM\...\StartupApproved\Run32: => "YTDownloader"
========================= Accounts: ==========================
==================== Faulty Device Manager Devices =============
Could not list Devices. Check "winmgmt" service or repair WMI.
==================== Event log errors: =========================
Could not start eventlog service, could not read events.
Systemfehler 5 aufgetreten.
Zugriff verweigert
==================== Memory info ===========================
Processor: AMD A6-6310 APU with AMD Radeon R4 Graphics
Percentage of memory in use: 62%
Total physical RAM: 3518.09 MB
Available physical RAM: 1306.25 MB
Total Pagefile: 4414.09 MB
Available Pagefile: 1635.6 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:439.5 GB) (Free:319.55 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
==================== End Of Log ============================
GMER ließ sich nicht ausführen, aufgrund folgender Fehlermeldung. Code:
C:\WINDOWS\system32\config\system: Der Prozess kann nicht auf die Dateien zugreifen, da sie von einem anderen Prozess verwendet werden.
Danach habe ich nochmals versucht auf meinem eigentlich Benutzeraccount einzuloggen.
Keine Meldung von Avast, keine Benutzerkontensteuerung, läuft... eigentlich.
Allerdings kommen immer noch 2 Meldungen:
RegSvr32: Code:
Fehler beim Laden des Moduls
"C:\ProgramData\MojjUtaw\WetayOdewu.atw".
Stellen sie sicher, dass die Binärdatei am angegeben
Pfad gespeichert ist, oder debuggen Sie die Datei, um
Probleme mit der binären Datei oder abhängigen
DLL-Dateien auszuschließen.
Der Vorgang konnte nicht erfolgreich abgeschlossen
werden, da die Datei einen Virus oder möglicherweise
unerwünschte Software enthält
RunDLL Code:
Problem beim Starten von C:\PROGRA~3\EAF79594b.cpp
Das angegebene Modul wurde nicht gefunden.
Ich vermute daher, dass immer noch etwas im Hintergrund aktiv ist.
Hier noch der Log vom Avast Scan: Code:
12/28/2014 11:34
Prüfung aller lokalen Laufwerke
Datei C:\Program Files\Common Files\System\SysMenu64.dll ist infiziert von Win32:Adware-CDO [PUP], Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\1YCP6HRJ\2A705B474D5945352B6D2143707D7D516779E5B95F32A784A51EA2FF1B3596D4B0BAFEC92FC04C2D60C32949C163F0E0[1].htm ist infiziert von HTML:RedirBA-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\1YCP6HRJ\8SXAGZ9F.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\1YCP6HRJ\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\0H5D97HS.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\DZX1JPSG.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\HGPFF8BA.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\AAXFUOCO\V4VJWICQ.htm ist infiziert von HTML:Iframe-inf, In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\BVB1K5PU\ads[4].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\15ZH2VMU.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\ads[3].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\GPLMM73O.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\KFMCAR1Y.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\GEFHBFT4\S1XTQDGI.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\KAI3YID8\L6BM1C80.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\bush-hospital[1].htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\E5BKMDV0.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\js[1].js ist infiziert von JS:ScriptPE-inf [Trj], Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\KCCKG8SB.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\TB8IZ766\U51OF1YE.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\V8ZLP8Y6\RAZ2X6S4.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\ads[1].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\ads[2].htm ist infiziert von JS:ScriptIP-inf [Trj], In Container verschoben
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\IU2XVET5.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Microsoft\Windows\INetCache\IE\X1IHDP50\IWMP8EAH.htm ist infiziert von HTML:Iframe-inf, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Temp\627D.tmp ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Users\janeisklar\AppData\Local\Temp\UpdateFlashPlayer_f48a8679.exe ist infiziert von Win32:MalOb-HX [Cryp], Gelöscht
Datei C:\Users\janeisklar\AppData\Roaming\EIZDOGM.exe ist infiziert von Win32:Malware-gen, Gelöscht
Datei C:\Users\janeisklar\AppData\Roaming\FRVOIK.exe ist infiziert von Win32:Trojan-gen, Gelöscht
Datei C:\Users\janeisklar\AppData\Roaming\WF.exe ist infiziert von Win32:Malware-gen, Gelöscht
Anzahl durchsuchter Ordner: 48632
Anzahl der geprüften Dateien: 441371
Anzahl infizierter Dateien: 31
Hoffe das ich alles wichtige gepostet habe.
Mit freundlichen Grüßen
Naxus |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
