Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Weisser Bildschirm und "please wait while the connection ist being established" (https://www.trojaner-board.de/163041-weisser-bildschirm-please-wait-while-the-connection-being-established.html)

schrauber 30.01.2015 09:36

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Tyler69 01.02.2015 13:40
Hallo Schrauber,
hier die log.txt
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5af218ebdb563e4ebe8f881f08577bc9
# engine=22248
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-01 10:38:17
# local_time=2015-02-01 11:38:17 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 114753469 260319952 0 0
# scanned=143405
# found=1
# cleaned=1
# scan_time=1773
sh=A4B7F7FB77D09C66F3A0051B3490CF00709BEB38 ft=1 fh=8eacab58e8988de9 vn="Variante von Win32/Kryptik.AGHX Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\_OTL\MovedFiles\01222015_182319\C_Users\*****\AppData\Roaming\game_client.exe"
und die checkup.txt
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5af218ebdb563e4ebe8f881f08577bc9
# engine=22248
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-01 10:38:17
# local_time=2015-02-01 11:38:17 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 114753469 260319952 0 0
# scanned=143405
# found=1
# cleaned=1
# scan_time=1773
sh=A4B7F7FB77D09C66F3A0051B3490CF00709BEB38 ft=1 fh=8eacab58e8988de9 vn="Variante von Win32/Kryptik.AGHX Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\_OTL\MovedFiles\01222015_182319\C_Users\*****\AppData\Roaming\game_client.exe"
und als letztes die frst.log


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01
Ran by SYSTEM on REATOGO on 01-02-2015 13:28:20
Running from G:\
Platform: Windows Vista (TM) Ultimate (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-31] (Realtek Semiconductor)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-20] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\*****\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\*****\...\Run: [CarryLaunch] => C:\Users\*****\AppData\Roaming\CoSoSys\CarryItEasy\CarryLaunch.exe [172032 2008-12-02] ()
HKU\*****\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [17351304 2011-10-13] (Skype Technologies S.A.)
HKU\*****\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation)

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [112800 2011-04-11] (Intel Corporation)
S3 maconfservice; C:\Program Files\ma-config.com\maconfservice.exe [311744 2011-05-01] (CybelSoft)
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-20] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 3xHybrid; C:\Windows\System32\DRIVERS\3xHybrid.sys [1025920 2009-08-26] (NXP Semiconductors Germany GmbH)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 driverhardwarev2; C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [14336 2010-08-30] (CybelSoft)
S3 IntelDH; C:\Windows\System32\Drivers\IntelDH.sys [5632 2011-06-14] (Intel Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-01] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios32_100507.sys [25912 2010-05-10] (Your Corporation)
S3 NTIOLib_1_0_8; C:\Program Files\MSI\MSIWDev\NTIOLib.sys [7680 2011-01-27] (MSI)
S3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.)
S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MpKslf24bea3d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{58A40002-A729-45D3-9B80-0F2239C5CE11}\MpKslf24bea3d.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 TSHWMDTCP; \??\C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 07:09 - 2015-02-01 07:09 - 00001105 _____ () C:\Users\*****\Desktop\checkup_x.txt
2015-02-01 06:51 - 2015-02-01 06:51 - 00852573 _____ () C:\Users\*****\Desktop\SecurityCheck.exe
2015-02-01 05:05 - 2015-02-01 05:05 - 02347384 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_deu.exe
2015-02-01 05:05 - 2015-02-01 05:05 - 00000000 ____D () C:\Program Files\ESET
2015-01-29 14:29 - 2015-01-29 14:29 - 00001371 _____ () C:\Users\*****\Documents\mbam.txt
2015-01-29 14:29 - 2015-01-29 14:29 - 00000000 ____D () C:\Windows\ERUNT
2015-01-29 12:59 - 2015-01-29 14:23 - 00000000 ____D () C:\AdwCleaner
2015-01-29 12:31 - 2015-02-01 06:37 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2015-01-29 12:30 - 2015-01-29 12:30 - 00000859 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-29 12:30 - 2015-01-29 12:30 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-01-29 12:30 - 2014-11-21 00:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2015-01-29 12:30 - 2014-11-21 00:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2015-01-29 12:30 - 2014-11-21 00:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2015-01-27 15:43 - 2015-01-27 15:45 - 00000000 ___SD () C:\ComboFix
2015-01-25 07:47 - 2011-06-26 01:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-25 07:47 - 2010-11-07 12:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-25 07:47 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-25 07:47 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-25 07:47 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-25 07:47 - 2000-08-30 19:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-25 07:47 - 2000-08-30 19:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-25 07:47 - 2000-08-30 19:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-25 07:37 - 2015-01-27 15:43 - 00000000 ___SD () C:\32788R22FWJFW
2015-01-25 07:37 - 2015-01-25 07:47 - 00000000 ____D () C:\Qoobox
2015-01-25 07:37 - 2015-01-25 07:37 - 00000000 ____D () C:\Windows\erdnt
2015-01-25 07:35 - 2015-01-27 15:43 - 05610622 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2015-01-25 07:33 - 2015-01-25 07:28 - 05609462 ____R (Swearware) C:\ComboFix.exe
2015-01-25 04:53 - 2015-01-25 04:56 - 00000000 ____D () C:\FRST
2015-01-22 18:23 - 2015-01-22 18:23 - 00000000 ____D () C:\_OTL
2015-01-21 17:17 - 2015-01-21 17:58 - 00078058 _____ () C:\OTL.Txt
2015-01-21 17:17 - 2015-01-21 17:23 - 00017666 _____ () C:\Extras.Txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 07:10 - 2008-01-20 20:37 - 01598866 _____ () C:\Windows\WindowsUpdate.log
2015-02-01 07:10 - 2006-11-02 07:46 - 00003712 _____ () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-01 07:10 - 2006-11-02 07:46 - 00003712 _____ () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-01 05:08 - 2008-01-21 01:12 - 00703472 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-01-29 14:24 - 2006-11-02 07:59 - 00026214 _____ () C:\Windows\PFRO.log
2015-01-29 12:32 - 2011-06-15 06:59 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2015-01-25 12:40 - 2011-06-15 07:30 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy
2015-01-25 08:39 - 2006-11-02 07:51 - 00116902 _____ () C:\Windows\setupact.log
2015-01-25 07:47 - 2011-06-15 06:10 - 00001945 _____ () C:\Windows\epplauncher.mif
2015-01-21 17:14 - 2011-05-25 01:16 - 00000000 ____D () C:\users\*****

Files to move or delete:
====================
C:\Users\*****\TuneUpUtilities2011_de-DE.exe
C:\Windows\Tasks\{A6500BFB-791B-458F-8B51-134812A0568E}.job


Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\sqlite3.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2011-09-25 02:48:35
Restore point made on: 2011-09-25 12:25:30
Restore point made on: 2011-09-26 12:20:32
Restore point made on: 2011-09-27 11:53:38
Restore point made on: 2011-09-27 12:10:45
Restore point made on: 2011-12-18 14:12:16
Restore point made on: 2011-12-24 05:10:03
Restore point made on: 2011-12-26 14:13:13
Restore point made on: 2011-12-27 15:30:04
Restore point made on: 2012-01-01 10:44:00
Restore point made on: 2012-01-02 14:15:24
Restore point made on: 2012-01-22 09:09:24
Restore point made on: 2012-01-22 14:00:28
Restore point made on: 2012-01-28 15:16:26
Restore point made on: 2012-01-28 17:04:09
Restore point made on: 2012-01-29 12:55:40
Restore point made on: 2012-02-05 10:40:27
Restore point made on: 2012-02-12 09:21:21
Restore point made on: 2012-02-15 05:21:56
Restore point made on: 2012-02-25 10:50:41
Restore point made on: 2012-03-31 13:24:06
Restore point made on: 2012-03-31 13:41:06
Restore point made on: 2012-03-31 15:14:17
Restore point made on: 2012-05-18 15:56:06
Restore point made on: 2012-05-18 17:55:58
Restore point made on: 2012-05-23 03:49:19
Restore point made on: 2012-05-24 15:52:58
Restore point made on: 2012-10-28 13:47:05
Restore point made on: 2012-10-28 13:48:10
Restore point made on: 2012-12-18 07:11:19
Restore point made on: 2012-12-18 07:12:04
Restore point made on: 2012-12-19 18:00:10
Restore point made on: 2012-12-20 18:00:08
Restore point made on: 2012-12-21 07:38:14
Restore point made on: 2015-01-21 10:46:43
Restore point made on: 2015-01-22 13:38:51
Restore point made on: 2015-01-29 13:45:44
Restore point made on: 2015-02-01 06:20:18

==================== Memory info ===========================

Percentage of memory in use: 16%
Total physical RAM: 2038.42 MB
Available physical RAM: 1701.62 MB
Total Pagefile: 1869.14 MB
Available Pagefile: 1757.34 MB
Total Virtual: 2047.88 MB
Available Virtual: 2001.49 MB

==================== Drives ================================

Drive b: (RAMDisk) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS
Drive c: () (Fixed) (Total:465.76 GB) (Free:362.86 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:1.92 GB) (Free:1.88 GB) FAT32
Drive x: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 9C25441F)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 4 (Size: 1.9 GB) (Disk ID: 0020F272)
Partition 1: (Active) - (Size=1.9 GB) - (Type=0B)


LastRegBack: 2015-02-01 05:18

==================== End Of Log ============================
--- --- ---


Sieht soweit gany gut aus, Desktopsymbole wieder da.
Teste dass System heute Abend etwas genauer.


Gruss
Tyler

schrauber 01.02.2015 17:37
FRST Log bitte aus dem normalen Modus :)

Tyler69 03.02.2015 17:17
Hallo Schrauber,

hier dass FRST.log

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-02-2015
Ran by ***** (administrator) on ***** on 03-02-2015 17:08:02
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** (Available profiles: *****)
Platform: Microsoft® Windows Vista™ Ultimate  Service Pack 2 (X86) OS Language: Tschechisch (Tschechische Republik)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
() C:\Users\*****\AppData\Roaming\CoSoSys\CarryItEasy\CarryLaunch.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(TuneUp Software) C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-31] (Realtek Semiconductor)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-84979143-2537804966-3357750443-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-84979143-2537804966-3357750443-1000\...\Run: [CarryLaunch] => C:\Users\*****\AppData\Roaming\CoSoSys\CarryItEasy\CarryLaunch.exe [172032 2008-12-02] ()
HKU\S-1-5-21-84979143-2537804966-3357750443-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [17351304 2011-10-13] (Skype Technologies S.A.)
HKU\S-1-5-21-84979143-2537804966-3357750443-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-84979143-2537804966-3357750443-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil11e_ActiveX.exe [247968 2012-01-25] (Adobe Systems, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [HKLM] =>
HKU\S-1-5-21-84979143-2537804966-3357750443-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-84979143-2537804966-3357750443-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> DefaultScope {878887F9-4F4C-42BF-A88C-7B8AFCC56EEB} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {02B124E6-DBDE-4855-8521-FBEB3A838D74} URL = hxxp://www.neckermann.de/link_go.mb1?link_id=9Ge-EQFCEeURZlvlw_WNk1DLjPzHz7&suchtext={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {1871B750-D127-4671-9469-3C39F416A692} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {21425FB7-02BD-4A13-9C2E-840FA1595A2D} URL = hxxp://suche.freenet.de/suche?query={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {2F7A5E37-5D02-47B5-9CEC-279212B2DB45} URL = hxxp://www.otto.de/extern/?AffiliateID=41609564&IWL=599&campid=5203&search_query_query_text={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {42E232DF-84CD-4A18-99F0-BA3318C9037B} URL = hxxp://www.amazon.de/gp/search?search-alias=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {6783E56B-0C4A-4CD5-BD2E-C0A5FA3B5E12} URL = hxxp://search.microsoft.com/results.aspx?mkt=de-DE&setlang=de-DE&q={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {878887F9-4F4C-42BF-A88C-7B8AFCC56EEB} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {913D9261-9CD8-49B3-B46D-68644876487A} URL = hxxp://suche.web.de/search/web/?su={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {9706A42F-04CF-437C-89D6-1EEF551EA4DB} URL = hxxp://suche.aol.de/suche/web/search.jsp?q={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {A4273244-B68B-4F59-9CE0-82F0BF084189} URL = hxxp://www.rtl.de/websuche.php?kw={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {C252BF75-D455-4DCD-B36E-7A61FEDA02F8} URL = hxxp://rover.ebay.com/rover/1/707-37276-23097-0/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {C58BDB03-ECFD-4D93-ABA7-184FA4F76CEC} URL = hxxp://de.wikipedia.org/wiki/Spezial:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {D7DC2B20-BC25-4224-A08E-BDFCE5D319DC} URL = hxxp://www.tchibo.de/is-bin/INTERSHOP.enfinity/eTS/Store/-/-/-/TdTchPartnerLink-Search?BannerID=3390&SourceID=908&search_query_keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-84979143-2537804966-3357750443-1000 -> {FD803AA0-C9C7-458C-A86F-21620435057F} URL = hxxp://suche.t-online.de/cgi-bin/swl?br=ie7&q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} hxxp://liveupdate.msi.com.tw/autobios/LOnline/RELEASECAB/install.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.200

FireFox:
========
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @ma-config.com/HardwareDetection -> C:\Program Files\ma-config.com\nphardwaredetection.dll (Cybelsoft)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-05-25]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [112800 2011-04-11] (Intel Corporation)
S3 maconfservice; C:\Program Files\ma-config.com\maconfservice.exe [311744 2011-05-01] (CybelSoft)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 3xHybrid; C:\Windows\System32\DRIVERS\3xHybrid.sys [1025920 2009-08-26] (NXP Semiconductors Germany GmbH)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 driverhardwarev2; C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [14336 2010-08-30] (CybelSoft)
S3 IntelDH; C:\Windows\System32\Drivers\IntelDH.sys [5632 2011-06-14] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios32_100507.sys [25912 2010-05-10] (Your Corporation)
S3 NTIOLib_1_0_8; C:\Program Files\MSI\MSIWDev\NTIOLib.sys [7680 2011-01-27] (MSI) [File not signed]
S3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.)
S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 MpKslf24bea3d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{58A40002-A729-45D3-9B80-0F2239C5CE11}\MpKslf24bea3d.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 TSHWMDTCP; \??\C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 17:08 - 2015-02-03 17:08 - 00012380 _____ () C:\Users\*****\Desktop\FRST.txt
2015-02-03 17:00 - 2015-02-03 17:00 - 01122304 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2015-02-01 12:51 - 2015-02-01 12:51 - 00852573 _____ () C:\Users\*****\Desktop\SecurityCheck.exe
2015-02-01 11:05 - 2015-02-01 11:05 - 02347384 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_deu.exe
2015-01-29 20:29 - 2015-01-29 20:29 - 00001371 _____ () C:\Users\*****\Documents\mbam.txt
2015-01-29 20:29 - 2015-01-29 20:29 - 00000000 ____D () C:\Windows\ERUNT
2015-01-29 18:59 - 2015-01-29 20:23 - 00000000 ____D () C:\AdwCleaner
2015-01-29 18:31 - 2015-02-03 16:57 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-29 18:30 - 2015-01-29 18:30 - 00000859 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-29 18:30 - 2015-01-29 18:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-29 18:30 - 2015-01-29 18:30 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-29 18:30 - 2015-01-29 18:30 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-01-29 18:30 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-29 18:30 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-29 18:30 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-27 21:43 - 2015-01-27 21:45 - 00000000 ___SD () C:\ComboFix
2015-01-25 13:47 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-25 13:47 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-25 13:47 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-25 13:47 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-25 13:47 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-25 13:47 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-25 13:47 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-25 13:47 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-25 13:37 - 2015-01-27 21:43 - 00000000 ___SD () C:\32788R22FWJFW
2015-01-25 13:37 - 2015-01-25 13:47 - 00000000 ____D () C:\Qoobox
2015-01-25 13:37 - 2015-01-25 13:37 - 00000000 ____D () C:\Windows\erdnt
2015-01-25 13:35 - 2015-01-27 21:43 - 05610622 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2015-01-25 13:33 - 2015-01-25 13:28 - 05609462 ____R (Swearware) C:\ComboFix.exe
2015-01-25 10:53 - 2015-02-03 17:08 - 00000000 ____D () C:\FRST
2015-01-23 00:23 - 2015-01-23 00:23 - 00000000 ____D () C:\_OTL
2015-01-21 23:17 - 2015-01-21 23:58 - 00078058 _____ () C:\OTL.Txt
2015-01-21 23:17 - 2015-01-21 23:23 - 00017666 _____ () C:\Extras.Txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 17:03 - 2008-01-21 07:12 - 00703472 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-03 17:00 - 2008-01-21 02:37 - 01610474 _____ () C:\Windows\WindowsUpdate.log
2015-02-03 16:57 - 2006-11-02 14:00 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-03 16:57 - 2006-11-02 13:46 - 00003712 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 16:57 - 2006-11-02 13:46 - 00003712 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 16:56 - 2006-11-02 13:59 - 00027004 _____ () C:\Windows\PFRO.log
2015-02-01 13:10 - 2006-11-02 14:00 - 00032540 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-29 18:32 - 2011-06-15 12:59 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2015-01-25 18:40 - 2011-06-15 13:30 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy
2015-01-25 18:39 - 2011-06-15 13:30 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-25 14:39 - 2006-11-02 13:51 - 00116902 _____ () C:\Windows\setupact.log
2015-01-25 13:47 - 2011-06-15 12:10 - 00001945 _____ () C:\Windows\epplauncher.mif
2015-01-21 23:14 - 2011-05-25 07:16 - 00000000 ____D () C:\Users\*****

==================== Files in the root of some directories =======

2011-08-18 21:37 - 2011-12-18 19:34 - 0000680 _____ () C:\Users\*****\AppData\Local\d3d9caps.dat
2008-02-05 13:28 - 2008-02-05 13:28 - 0000051 _____ () C:\Users\*****\AppData\Local\setup.txt

Files to move or delete:
====================
C:\Users\*****\TuneUpUtilities2011_de-DE.exe
C:\Windows\Tasks\{A6500BFB-791B-458F-8B51-134812A0568E}.job


Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 17:05

==================== End Of Log ============================
--- --- ---


ich habe noch mal die Addition.txt rangehängt.
Sieht so aus als wäre die Host-Datei noch nicht sauber.
Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 01-02-2015
Ran by ***** at 2015-02-03 17:08:36
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Reader X (10.1.0) - Czech (HKLM\...\{AC76BA86-7AD7-1029-7B44-AA1000000001}) (Version: 10.1.0 - Adobe Systems Incorporated)
Anglický překladový slovník Lingea pro MS Office 2003 (HKLM\...\{10627FCE-B1C9-4E78-AFCA-5AAE11774442}) (Version: 1.00.0000 - Lingea s.r.o.)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
foobar2000 v1.1.6 (HKLM\...\foobar2000) (Version: 1.1.6 - Peter Pawlowski)
Free Easy Burner V 4.4.1 (HKLM\...\Free Easy Burner_is1) (Version: 4.4.1.0 - Koyote soft)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
Intel(R) Network Connections 16.3.48.0 (HKLM\...\PROSetDX) (Version: 16.3.48.0 - Intel)
Intel(R) Processor ID Utility (HKLM\...\{A92A4DB0-CD37-42D1-BE1D-603D53C24328}) (Version: 4.31.0000 - Intel(R) Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
Java(TM) 6 Update 26 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216025FF}) (Version: 6.0.260 - Oracle)
K-Lite Mega Codec Pack 7.1.8 (HKLM\...\KLiteCodecPack_is1) (Version: 7.1.8 - )
Kontrola české gramatiky pro sadu Microsoft Office 2003 (HKLM\...\{A62392EE-03CB-4FA8-8E79-B5F95A346FB3}) (Version: 1.0.0 - Microsoft Corporation)
Ma-Config.com (HKLM\...\{C54E86AA-7B18-4AB6-84EA-D74A85A5BAE8}) (Version: 5.1.050 - Cybelsoft)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 SP1 – jazyková sada – CSY (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - csy) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2003 Czech User Interface Pack (HKLM\...\{901E0405-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office 2003 German User Interface Pack (HKLM\...\{901E0407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2005 (HKLM\...\Microsoft Report Viewer Redistributable 2005) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 SP1 (HKLM\...\Microsoft Report Viewer Redistributable 2008 (KB971119)) (Version:  - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (KB2549864) (HKLM\...\{1282C0BC-3B22-33D4-B72E-62922415DDCA}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Windows Media Video 9 VCM (HKLM\...\WMV9_VCM) (Version:  - )
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Německý překladový slovník Lingea pro MS Office 2003 (HKLM\...\{70E42F24-B920-4CDE-BB99-7B9CE881ED6A}) (Version: 1.00.0000 - Lingea s.r.o.)
OpenOffice.org 3.3 (HKLM\...\{D5B94160-4A07-4956-9C73-8C5EEFEF180F}) (Version: 3.3.9567 - OpenOffice.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.1 - Frank Heindörfer, Philip Chinery)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.8 - Google, Inc.)
QuickTime Alternative 3.2.2 (HKLM\...\QuicktimeAlt_is1) (Version: 3.2.2 - )
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6383 - Realtek Semiconductor Corp.)
Skype™ 5.5 (HKLM\...\{AA59DDE4-B672-4621-A016-4C248204957A}) (Version: 5.5.124 - Skype Technologies S.A.)
System Requirements Lab for Intel (HKLM\...\{CD41B576-4787-4D5C-95EE-24A4ABD89CD3}) (Version: 4.4.24.0 - Husdawg, LLC)
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 7.56a - Ghisler Software GmbH)
TuneUp Utilities 2011 (HKLM\...\TuneUp Utilities 2011) (Version: 10.0.4600.4 - TuneUp Software)
TuneUp Utilities 2011 (Version: 10.0.4600.4 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.4600.4 - TuneUp Software) Hidden
Ultimate Extras sounds from Microsoft® Tinker™ (HKLM\...\UltSounds2) (Version:  - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM\...\Windows Media Encoder 9) (Version:  - )
Zvuková schémata systému Windows (HKLM\...\UltSounds) (Version:  - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

25-09-2011 08:48:23 Geplanter Prüfpunkt
25-09-2011 18:25:20 Windows Update
26-09-2011 18:20:13 Windows Update
27-09-2011 17:53:26 Geplanter Prüfpunkt
27-09-2011 18:10:38 Windows Update
18-12-2011 20:11:23 Windows Update
24-12-2011 11:09:33 Windows Update
26-12-2011 20:12:44 Windows Update
27-12-2011 21:29:35 Windows Update
01-01-2012 16:42:48 Windows Update
02-01-2012 20:15:01 Windows Update
22-01-2012 15:08:45 Windows Update
22-01-2012 20:00:14 Windows Update
28-01-2012 21:15:57 Windows Update
28-01-2012 23:04:00 Windows Update
29-01-2012 18:55:14 Windows Update
05-02-2012 16:40:12 Windows Update
12-02-2012 15:20:34 Windows Update
15-02-2012 11:21:07 Windows Update
25-02-2012 16:50:19 Windows Update
31-03-2012 19:22:43 Windows Update
31-03-2012 19:40:48 Windows Update
31-03-2012 21:14:09 Windows Update
18-05-2012 21:55:29 Windows Update
18-05-2012 23:55:51 Windows Update
23-05-2012 09:48:51 Windows Update
24-05-2012 21:52:17 Microsoft Antimalware Checkpoint
28-10-2012 19:45:38 Microsoft Antimalware Checkpoint
28-10-2012 19:48:02 Windows Update
18-12-2012 13:07:44 Microsoft Antimalware Checkpoint
18-12-2012 13:09:38 Windows Update
20-12-2012 00:00:03 Geplanter Prüfpunkt
21-12-2012 00:00:01 Geplanter Prüfpunkt
21-12-2012 13:38:08 Geplanter Prüfpunkt
21-01-2015 16:46:22 Microsoft Antimalware Checkpoint
22-01-2015 19:38:44 Geplanter Prüfpunkt
29-01-2015 19:45:29 Geplanter Prüfpunkt
01-02-2015 12:20:02 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2011-06-16 09:41 - 00435149 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com
127.0.0.1        www.100sexlinks.com
127.0.0.1        100sexlinks.com
127.0.0.1        10sek.com
127.0.0.1        www.10sek.com
127.0.0.1        www.1-2005-search.com
127.0.0.1        1-2005-search.com
127.0.0.1        123fporn.info
127.0.0.1        www.123fporn.info
127.0.0.1        123haustiereundmehr.com
127.0.0.1        www.123haustiereundmehr.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {31A53BB7-466E-44F3-A879-2583864DC82C} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08] (Sun Microsystems, Inc.)
Task: {94A9E4B9-62FC-4692-9655-98D87E4D629C} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files\TuneUp Utilities 2011\OneClick.exe [2011-12-13] (TuneUp Software)
Task: {A801A3C0-B514-49B5-9D5D-DFDCB7F44CF0} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\{A6500BFB-791B-458F-8B51-134812A0568E}.job => C:\Program Files\Internet Explorer\iexplore.exe

==================== Loaded Modules (whitelisted) =============

2011-06-15 13:25 - 2001-10-28 16:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll
2011-08-18 21:59 - 2008-12-02 10:40 - 00172032 _____ () C:\Users\*****\AppData\Roaming\CoSoSys\CarryItEasy\CarryLaunch.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-84979143-2537804966-3357750443-500 - Administrator - Disabled)
Guest (S-1-5-21-84979143-2537804966-3357750443-501 - Limited - Disabled)
***** (S-1-5-21-84979143-2537804966-3357750443-1000 - Administrator - Enabled) => C:\Users\*****

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/03/2015 05:03:22 PM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/03/2015 05:03:22 PM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/03/2015 04:58:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/01/2015 11:08:05 AM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/01/2015 11:08:04 AM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/01/2015 11:02:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (02/03/2015 04:58:28 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (02/01/2015 11:02:39 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032


Microsoft Office Sessions:
=========================
Error: (02/03/2015 05:03:22 PM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/03/2015 05:03:22 PM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/03/2015 04:58:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/01/2015 11:08:05 AM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/01/2015 11:08:04 AM) (Source: LoadPerf) (EventID: 3012) (User: )
Description: Performance16

Error: (02/01/2015 11:02:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2015-02-03 17:08:32.951
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:32.745
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:32.536
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:32.330
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:31.995
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:31.790
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:31.584
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:31.380
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:11.017
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-03 17:08:10.811
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz
Percentage of memory in use: 50%
Total physical RAM: 2037.77 MB
Available physical RAM: 1012.06 MB
Total Pagefile: 4320.8 MB
Available Pagefile: 3123.36 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.14 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:363.05 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 9C25441F)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 03.02.2015 21:10
Doch die ist sauber. Die Einträge kommen von Schutzsoftware :)


Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Tyler69 07.02.2015 10:27
Hallo Schrauber,

PC läuft wieder besten Dank für deine Hilfe!

Gruß
Tyler

schrauber 07.02.2015 12:58
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:41 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19