Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Gerade qvo6.com eingefangen, avira meldet mehrer Fälle in Quarantäne (https://www.trojaner-board.de/142606-gerade-qvo6-com-eingefangen-avira-meldet-mehrer-faelle-quarantaene.html)

wolly0209 06.10.2013 14:31
Gerade qvo6.com eingefangen, avira meldet mehrer Fälle in Quarantäne
 
Offensichtlich habe ich mir gerade "qvo6.com" eingefangen. Mein Avira meldet zudem in Quarantäne: "adware/InstallCore.gen", "TR/Crypt.cfi.56" vom 06.10.2013 und "EXP/CVE-2013-2423.PF", aber bereits vom 26.08.2013.
Was ist zu tun, ohne das System neu aufsetzen zu müssen?

Danke für die Hilfe!

wolly0209

t'john 06.10.2013 14:35
:hallo:

Log von Antivir so erstellen: http://www.trojaner-board.de/125889-...en-posten.html


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


wolly0209 06.10.2013 14:55
Hallo t'john,
danke für das Hilfsangebot.

Hier das Logfile von avira:

Code:
Exportierte Ereignisse:

06.10.2013 14:25 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan].
      Durchgeführte Aktion(en):
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
      Die Datei konnte nicht gelöscht werden!
      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
      Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden!
      Die Datei existiert nicht!

06.10.2013 14:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\is1590112554\8971515_stp\uninstaller.exe'
      enthielt einen Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen'
      [adware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5759c63f.qua'
      verschoben!

06.10.2013 14:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5779c976.qua'
      verschoben!

06.10.2013 14:24 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:24 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:24 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:23 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:23 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:23 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:22 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:22 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\eIntaller\D81435D596B6466497C76FF031585075\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.cfi.56' [trojan] gefunden.
      Ausgeführte Aktion: Übergeben an Scanner

06.10.2013 14:21 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\is1590112554\8971515_stp\uninstaller.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen' [adware]
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

06.10.2013 14:21 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Wolfgang
      Hxxxx\AppData\Local\Temp\is1590112554\8971515_stp\uninstaller.exe'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen' [adware]
      gefunden.
      Ausgeführte Aktion: Übergeben an Scanner
Hier nun die beiden Logfiles:
FRST


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Wolfgang Hxxxx (administrator) on Hxxxx-LAPTOP on 06-10-2013 15:43:18
Running from C:\Users\Wolfgang Hxxxx\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Google) C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
(AVM Berlin) C:\Program Files\FRITZ!\IWatch.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_8_800_175_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NPSStartup] - [x]
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [OpwareSE2] - C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM\...\Run: [OPSE reminder] - C:\Program Files\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe [729088 2003-07-07] ()
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKCU\...\Run: [Media Finder] - "C:\Program Files\Media Finder\Media Finder.exe" /opentotray
MountPoints2: {cfaa2137-7da3-11e1-b82a-001f1614721a} - H:\autorun.exe setup.exe -suppressUpToDateInfo

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x17946135C7D2CC00
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141&type=default&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141&type=default&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141&type=default&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141&type=default&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Help the General-Search Project - {CA4520F3-AE13-4FB1-A513-58E23991C86D} - C:\Users\WOLFGA~1\AppData\Roaming\MEDIAF~1\EXTENS~1\GENCRA~1.DLL ()
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Wolfgang Hxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\ycmfar0d.default
FF user.js: detected! => C:\Users\Wolfgang Hxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\ycmfar0d.default\user.js
FF DefaultSearchEngine: qvo6
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Wolfgang Hxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\ycmfar0d.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Wolfgang Hxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\ycmfar0d.default\searchplugins\BrowserProtect.xml
FF SearchPlugin: C:\Users\Wolfgang Hxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\ycmfar0d.default\searchplugins\delta.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\qvo6.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: General Crawler - C:\Users\Wolfgang Hxxxx\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\30.0.1599.69\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Search-Gol Toolbar) - C:\Users\WOLFGA~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aipfmkinhleccnodemkoofnnofpbbpac\1.0_0
CHR Extension: (Google Docs) - C:\Users\WOLFGA~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (General Crawler) - C:\Users\WOLFGA~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel\2.6_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\WOLFGA~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR HKLM\...\Chrome\Extension: [aipfmkinhleccnodemkoofnnofpbbpac] - C:\Users\Wolfgang Hxxxx\AppData\Roaming\BabSolution\CR\searchgol.crx
CHR HKLM\...\Chrome\Extension: [dednnpigldgdbpgcdpfppmlcnnbjciel] - C:\Users\Wolfgang Hxxxx\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.crx
CHR HKLM\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Wolfgang Hxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
CHR HKLM\...\Chrome\Extension: [lpmkgpnbiojfaoklbkpfneikocaobfai] - C:\Users\Wolfgang Hxxxx\AppData\Roaming\Media Finder\Extensions\mf_plugin_gc.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=WDCXWD3200BEVT-22ZCT0_WD-WXEY08HA1728A1728&ts=1381062141

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [7454608 2013-05-09] (DisplayLink Corp.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-06-20] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-06-20] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-21] (Avira Operations GmbH & Co. KG)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64000 2009-07-14] (AVM GmbH)
R3 AX88772; C:\Windows\System32\DRIVERS\ax88772.sys [66048 2011-06-01] (ASIX Electronics Corp.)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R3 DisplayLinkUsbIo; C:\Windows\System32\DRIVERS\DisplayLinkUsbIo_7.2.47873.0.sys [36752 2013-05-13] ()
R3 dlkmd; C:\Windows\system32\drivers\dlkmd.sys [338736 2013-05-09] (DisplayLink Corp.)
R0 dlkmdldr; C:\Windows\System32\drivers\dlkmdldr.sys [15664 2013-05-09] (DisplayLink Corp.)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 FXUSBASE; C:\Windows\System32\DRIVERS\fxusbase.sys [588928 2009-07-14] (AVM Berlin)
S3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
S3 LAN9500; C:\Windows\System32\DRIVERS\lan9500-x86-n51f.sys [57344 2012-04-03] (SMSC)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-03-03] (Avira GmbH)
S3 DisplayLinkUsbPort; system32\DRIVERS\DisplayLinkUsbPort_6.3.40660.0.sys [x]
S3 dlcdbus; system32\DRIVERS\dlcdbus.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-06 15:43 - 2013-10-06 15:43 - 00000000 ____D C:\FRST
2013-10-06 15:41 - 2013-10-06 15:41 - 01087213 _____ (Farbar) C:\Users\Wolfgang Hxxxx\Desktop\FRST.exe
2013-10-06 15:38 - 2013-10-06 15:38 - 00009376 _____ C:\Users\Wolfgang Hxxxx\Desktop\Ereignisse.txt
2013-10-06 15:21 - 2013-10-06 15:21 - 00000096 _____ C:\Users\Wolfgang Hxxxx\AppData\Roaming\WB.CFG
2013-10-06 14:57 - 2013-10-06 14:58 - 00000000 ____D C:\AdwCleaner
2013-10-06 14:55 - 2013-10-06 14:55 - 01045226 _____ C:\Users\Wolfgang Hxxxx\Desktop\adwcleaner_3.0.0.6.exe
2013-10-06 14:27 - 2013-10-06 14:27 - 00000000 ____D C:\Users\Wolfgang Hxxxx\Documents\Optimizer Pro
2013-10-06 14:26 - 2013-10-06 14:26 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Local\avgchrome
2013-10-06 14:22 - 2013-10-06 14:28 - 00000000 ____D C:\Program Files\BonanzaDealsLive
2013-10-06 14:22 - 2013-10-06 14:22 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Roaming\BabSolution
2013-10-06 14:22 - 2013-10-06 14:22 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Local\BonanzaDealsLive
2013-10-06 14:22 - 2013-10-06 14:22 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-10-06 14:21 - 2013-10-06 14:26 - 00000000 ____D C:\Program Files\BonanzaDeals
2013-10-06 14:21 - 2013-10-06 14:21 - 00000316 _____ C:\Windows\Tasks\DigitalSite.job
2013-10-06 14:21 - 2013-10-06 14:21 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Roaming\DigitalSite
2013-09-12 20:45 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 20:45 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 20:45 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 20:45 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 20:45 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 20:45 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 20:45 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 20:40 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 20:40 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 20:39 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 20:39 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 20:39 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 20:39 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 20:39 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 20:39 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 20:39 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

==================== One Month Modified Files and Folders =======

2013-10-06 15:43 - 2013-10-06 15:43 - 00000000 ____D C:\FRST
2013-10-06 15:41 - 2013-10-06 15:41 - 01087213 _____ (Farbar) C:\Users\Wolfgang Hxxxx\Desktop\FRST.exe
2013-10-06 15:38 - 2013-10-06 15:38 - 00009376 _____ C:\Users\Wolfgang Hxxxx\Desktop\Ereignisse.txt
2013-10-06 15:21 - 2013-10-06 15:21 - 00000096 _____ C:\Users\Wolfgang Hxxxx\AppData\Roaming\WB.CFG
2013-10-06 15:17 - 2012-11-16 18:31 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-06 15:16 - 2012-03-31 21:47 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-06 14:58 - 2013-10-06 14:57 - 00000000 ____D C:\AdwCleaner
2013-10-06 14:55 - 2013-10-06 14:55 - 01045226 _____ C:\Users\Wolfgang Hxxxx\Desktop\adwcleaner_3.0.0.6.exe
2013-10-06 14:41 - 2009-07-14 06:34 - 00022048 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-06 14:41 - 2009-07-14 06:34 - 00022048 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-06 14:38 - 2012-01-14 15:47 - 01179838 _____ C:\Windows\WindowsUpdate.log
2013-10-06 14:34 - 2012-11-16 18:31 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-06 14:33 - 2010-11-20 23:48 - 00405812 _____ C:\Windows\PFRO.log
2013-10-06 14:33 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-06 14:33 - 2009-07-14 06:39 - 00083133 _____ C:\Windows\setupact.log
2013-10-06 14:28 - 2013-10-06 14:22 - 00000000 ____D C:\Program Files\BonanzaDealsLive
2013-10-06 14:27 - 2013-10-06 14:27 - 00000000 ____D C:\Users\Wolfgang Hxxxx\Documents\Optimizer Pro
2013-10-06 14:26 - 2013-10-06 14:26 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Local\avgchrome
2013-10-06 14:26 - 2013-10-06 14:21 - 00000000 ____D C:\Program Files\BonanzaDeals
2013-10-06 14:23 - 2013-05-24 16:00 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-06 14:23 - 2013-01-15 18:29 - 00002513 _____ C:\Users\Wolfgang Hxxxx\Desktop\Google Chrome.lnk
2013-10-06 14:23 - 2012-03-11 16:23 - 00001734 _____ C:\Users\Wolfgang Hxxxx\Desktop\Firefox.lnk
2013-10-06 14:23 - 2012-01-15 10:32 - 00001689 _____ C:\Users\Wolfgang Hxxxx\Desktop\Internet Explorer.lnk
2013-10-06 14:23 - 2012-01-14 16:15 - 00001719 _____ C:\Users\Wolfgang Hxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-10-06 14:22 - 2013-10-06 14:22 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Roaming\BabSolution
2013-10-06 14:22 - 2013-10-06 14:22 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Local\BonanzaDealsLive
2013-10-06 14:22 - 2013-10-06 14:22 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-10-06 14:21 - 2013-10-06 14:21 - 00000316 _____ C:\Windows\Tasks\DigitalSite.job
2013-10-06 14:21 - 2013-10-06 14:21 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Roaming\DigitalSite
2013-10-06 12:53 - 2013-05-25 16:54 - 00000000 ____D C:\Users\Wolfgang Hxxxx\Documents\Online-BankingPlus
2013-10-06 11:45 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-10-04 18:14 - 2012-02-08 18:43 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Roaming\Canon
2013-10-03 16:55 - 2010-11-20 23:01 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-29 19:34 - 2012-01-15 10:47 - 00000000 ____D C:\Users\Wolfgang Hxxxx\AppData\Roaming\Mp3tag
2013-09-26 19:35 - 2012-01-14 16:15 - 00000000 ____D C:\Users\Wolfgang Hxxxx
2013-09-19 19:16 - 2012-03-31 21:47 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-19 19:16 - 2012-01-15 14:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-15 10:49 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-09-15 10:01 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-15 09:45 - 2009-07-14 06:33 - 00297992 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 22:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-12 20:48 - 2009-07-14 04:04 - 00000528 _____ C:\Windows\win.ini
2013-09-12 20:43 - 2013-07-11 18:03 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 20:41 - 2012-01-14 17:27 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll
C:\Users\Jutta\AppData\Local\Temp\install_reader10_de_gtba_aih.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\DeltaTB.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\Optimizer_Pro.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\uninst1.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-03 18:02

==================== End Of Log ============================
--- --- ---


und Addition.txt:

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Wolfgang Hxxxx at 2013-10-06 15:44:23
Running from C:\Users\Wolfgang Hxxxx\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Adobe Flash Player 11 ActiveX (Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8)
Apple Application Support (Version: 2.1.6)
Apple Mobile Device Support (Version: 4.0.0.97)
Apple Software Update (Version: 2.1.3.127)
ArcSoft PhotoStudio 5.5
Avira Free Antivirus (Version: 13.0.0.4052)
AVM FRITZ!
AX88772A (Version: 1.01)
Banking (Version: 7.04.0010)
Bundled software uninstaller
Canon MP Navigator 2.0
Canon Utilities Easy-PhotoPrint
CDex - Open Source Digital Audio CD Extractor (Version: 1.70.4.2009)
CD-LabelPrint
Chart Navigator Light
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000)
DisplayLink Core Software (Version: 7.2.47873.0)
DisplayLink Graphics (Version: 5.5.29194.0)
Easy-WebPrint
Feurio! CD-Writer
FinePrint (Version: 6.25)
Free M4a to MP3 Converter 7.0
Free WMA to MP3 Converter 1.08
Free YouTube to MP3 Converter Studio 7.4
Google Calendar Sync
Google Chrome (Version: 30.0.1599.69)
Google Earth Plug-in (Version: 7.1.1.1888)
Google Update Helper (Version: 1.3.21.153)
Java 7 Update 17 (Version: 7.0.170)
Java Auto Updater (Version: 2.1.9.0)
Java SE Development Kit 7 Update 10 (Version: 1.7.0.100)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office Basic Edition 2003 (Version: 11.0.8173.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 21.0 (x86 de) (Version: 21.0)
Mozilla Maintenance Service (Version: 21.0)
Mp3tag v2.57 (Version: v2.57)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyPhoneExplorer (Version: 1.8.5)
NVIDIA Display Control Panel (Version: 1.6)
NVIDIA Drivers (Version: 1.10)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.109.718)
NVIDIA PhysX (Version: 9.09.0814)
OmniPage SE 2.0 (Version: 2.00.0004)
Online-Banking+
Online-Banking+ (Version: 15.2.1.18)
streamWriter
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
USB PortReplicator PR07 (Version: 1.01)
Winamp (Version: 5.623 )
WinRAR Archivierer

==================== Restore Points  =========================

07-07-2013 10:44:34 Windows Update
07-07-2013 17:00:08 Windows-Sicherung
10-07-2013 17:28:33 Windows Update
11-07-2013 15:30:52 Windows Update
11-07-2013 16:02:55 Windows Update
16-07-2013 17:35:38 Windows-Sicherung
16-07-2013 17:36:36 Windows Update
23-07-2013 15:59:44 Windows Update
23-07-2013 15:59:53 Windows-Sicherung
28-07-2013 18:42:27 Windows-Sicherung
28-07-2013 18:43:34 Windows Update
02-08-2013 12:19:18 Windows Update
04-08-2013 17:00:12 Windows-Sicherung
05-08-2013 14:42:05 Windows Update
09-08-2013 11:55:09 Windows Update
25-08-2013 16:22:33 Windows Update
25-08-2013 16:31:15 Windows-Sicherung
25-08-2013 16:42:28 Windows Update
29-08-2013 16:05:32 Windows Update
01-09-2013 17:00:08 Windows-Sicherung
02-09-2013 15:28:18 Windows Update
08-09-2013 15:12:28 Windows Update
08-09-2013 17:00:15 Windows-Sicherung
11-09-2013 16:22:59 Windows Update
12-09-2013 18:40:36 Windows Update
15-09-2013 17:00:08 Windows-Sicherung
16-09-2013 16:45:42 Windows Update
19-09-2013 17:23:14 Windows Update
23-09-2013 16:25:15 Windows-Sicherung
23-09-2013 16:25:19 Windows Update
27-09-2013 13:10:54 Windows Update
29-09-2013 17:00:13 Windows-Sicherung
30-09-2013 15:32:08 Windows Update
04-10-2013 15:00:25 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {267A808D-9527-4ACA-8CA1-EA5620D7278C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-19] (Adobe Systems Incorporated)
Task: {2D471D86-6D39-4576-8C5E-BE526F3D1090} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {33E28274-7CDE-47B6-B376-DACE62E5D078} - System32\Tasks\EPUpdater => C:\Users\WOLFGA~1\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [2013-09-01] ()
Task: {680BA395-EDFC-487C-B8E7-719C27BAC06D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-11-16] (Google Inc.)
Task: {A91656B8-B8C1-4304-849A-6667172F675E} - System32\Tasks\DigitalSite => C:\Users\WOLFGA~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE [2013-04-12] ()
Task: {D388AA40-6F03-4684-BF07-FE353E16B39F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-11-16] (Google Inc.)
Task: {DF375268-0E22-4BB8-9039-31AD1AFD3AA5} - System32\Tasks\{38E2B3E4-2EBB-4DE4-93BF-3BE8D04D5C1B} => C:\Program Files\Musikminister\MM.EXE [1992-12-01] ()
Task: {E3A7EF3D-EF08-42CA-A3D3-05307467E4F8} - System32\Tasks\{29BD7A74-F235-4885-9F8E-AE6734B59778} => C:\android-sdk\SDKManager.exe
Task: {F2BBF9F2-88F2-4269-97AC-1A5282A6E777} - System32\Tasks\{989A62EC-10D4-4E0D-9E6C-88E2A1E990D1} => C:\android-sdk\SDKManager.exe
Task: {F3829216-E3D0-4E6A-A045-D845BFCB48E8} - System32\Tasks\{DD073320-1F60-42A3-A305-1EF81B855F6B} => C:\Program Files\Musikminister\MM.EXE [1992-12-01] ()
Task: {FE1C9DF1-0CDA-43CF-BAE6-C1980535F04C} - System32\Tasks\{D81AF0BC-6C24-45B6-BA00-A254626D557E} => C:\Program Files\Musikminister\MM.EXE [1992-12-01] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\WOLFGA~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/06/2013 02:35:21 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 02:24:25 PM) (Source: MsiInstaller) (User: Hxxxx-Laptop)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\GoogleUpdateHelper.msi

Error: (10/06/2013 11:53:06 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 10:45:32 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/06/2013 09:51:27 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 05:34:07 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 08:44:34 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/04/2013 07:38:19 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/03/2013 05:52:52 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (10/03/2013 04:51:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (10/06/2013 02:33:47 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎06.‎10.‎2013 um 14:32:11 unerwartet heruntergefahren.

Error: (10/04/2013 05:33:08 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎04.‎10.‎2013 um 17:30:58 unerwartet heruntergefahren.

Error: (09/30/2013 05:20:50 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎29.‎09.‎2013 um 22:27:56 unerwartet heruntergefahren.

Error: (09/29/2013 09:30:22 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎28.‎09.‎2013 um 18:32:49 unerwartet heruntergefahren.

Error: (09/26/2013 05:18:34 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎25.‎09.‎2013 um 23:10:27 unerwartet heruntergefahren.

Error: (09/25/2013 05:27:01 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎23.‎09.‎2013 um 22:24:56 unerwartet heruntergefahren.

Error: (09/19/2013 07:08:22 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎18.‎09.‎2013 um 19:50:30 unerwartet heruntergefahren.

Error: (09/18/2013 05:09:08 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎17.‎09.‎2013 um 22:13:44 unerwartet heruntergefahren.

Error: (09/17/2013 04:48:36 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎16.‎09.‎2013 um 22:44:57 unerwartet heruntergefahren.

Error: (09/15/2013 10:01:01 PM) (Source: Server) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{21E1270D-7231-415A-B924-ACAC0196CF3C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.


Microsoft Office Sessions:
=========================
Error: (10/06/2013 02:35:21 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 02:24:25 PM) (Source: MsiInstaller)(User: Hxxxx-Laptop)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\GoogleUpdateHelper.msi(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/06/2013 11:53:06 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/06/2013 10:45:32 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/06/2013 09:51:27 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 05:34:07 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 08:44:34 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/04/2013 07:38:19 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/03/2013 05:52:52 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (10/03/2013 04:51:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 34%
Total physical RAM: 3066.88 MB
Available physical RAM: 2012.45 MB
Total Pagefile: 6132.04 MB
Available Pagefile: 4717.99 MB
Total Virtual: 2047.88 MB
Available Virtual: 1894.69 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:278.08 GB) (Free:200.87 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (SICHERUNG) (Fixed) (Total:20 GB) (Free:8.5 GB) FAT32
Drive g: (Daten 3) (Fixed) (Total:465.76 GB) (Free:3.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 366F456C)
Partition 1: (Active) - (Size=278 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=20 GB) - (Type=0C)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: 0A1D648B)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Hoffentlich hilft das.
Danke

t'john 06.10.2013 15:07
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
2013-10-06 14:55 - 2013-10-06 14:55 - 01045226 _____ C:\Users\Wolfgang Hxxxx\Desktop\adwcleaner_3.0.0.6.exe
C:\Users\Jutta\AppData\Local\Temp\install_reader10_de_gtba_aih.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\DeltaTB.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\Optimizer_Pro.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\uninst1.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




dann:
Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers



dann:

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


wolly0209 06.10.2013 16:21
Hallo,

hier erst einmal die Fixlog.txt:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by Wolfgang Hxxxx at 2013-10-06 16:24:43 Run:1
Running from C:\Users\Wolfgang Hxxxx\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
2013-10-06 14:55 - 2013-10-06 14:55 - 01045226 _____ C:\Users\Wolfgang Hxxxx\Desktop\adwcleaner_3.0.0.6.exe
C:\Users\Jutta\AppData\Local\Temp\install_reader10_de_gtba_aih.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\DeltaTB.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\Optimizer_Pro.exe
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\uninst1.exe
*****************

C:\Users\Wolfgang Hxxxx\Desktop\adwcleaner_3.0.0.6.exe  => Moved successfully.
C:\Users\Jutta\AppData\Local\Temp\install_reader10_de_gtba_aih.exe  => Moved successfully.
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\DeltaTB.exe  => Moved successfully.
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe  => Moved successfully.
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\Optimizer_Pro.exe  => Moved successfully.
C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\uninst1.exe => Moved successfully.

==== End of Fixlog ====
Die weiteren Files folgen.

So,
hier sind jetzt die beiden logfiles:

mbar:

Code:
Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.10.06.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16686
Wolfgang Hxxxx :: Hxxxx-LAPTOP [administrator]

06.10.2013 16:52:57
mbar-log-2013-10-06 (16-52-57).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 221770
Time elapsed: 11 minute(s), 51 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
und die JRT:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows 7 Professional x86
Ran by Wolfgang Hxxxx on 06.10.2013 at 17:05:32,37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\media finder



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\babsolution
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\babylontoolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\bi
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\delta ltd
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\dsiteproducts
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installcore
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\mediafinder
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\pricegong
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\download with &media finder
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1598076674-1139964559-1205766370-1001\Software\SweetIM
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\babylon
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\qvo6software
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\mf
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.eb_explorerbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.eb_explorerbar.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.ipm_printlistitem
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.ipm_printlistitem.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pm_launcher
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pm_launcher.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pm_printmanager
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pm_printmanager.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pr_bindstatuscallback
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pr_bindstatuscallback.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pr_cancelbuttoneventhandler
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.pr_cancelbuttoneventhandler.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.tbtoolband
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.tbtoolband.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.useroptions
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\toolband.useroptions.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricegong_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricegong_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_android-sdk_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_android-sdk_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_cdex_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_cdex_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\digitalsite
Successfully deleted: [File] C:\Windows\System32\Tasks\epupdater
Successfully deleted: [File] C:\Windows\Tasks\digitalsite.job
Successfully disinfected: [Shortcut] C:\Users\Wolfgang Hxxxx\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Successfully disinfected: [Shortcut] C:\Users\Wolfgang Hxxxx\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Successfully disinfected: [Shortcut] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Successfully disinfected: [Shortcut] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Successfully disinfected: [Shortcut] C:\Users\Wolfgang Hxxxx\AppData\Roaming\microsoft\windows\start menu\Programme\Internet Explorer.lnk
Successfully disinfected: [Shortcut] C:\Users\Wolfgang Hxxxx\AppData\Roaming\microsoft\windows\start menu\Programme\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Successfully repaired: [Shortcut] C:\Users\Wolfgang Hxxxx\desktop\Firefox.lnk
Successfully repaired: [Shortcut] C:\Users\Wolfgang Hxxxx\desktop\Google Chrome.lnk
Successfully repaired: [Shortcut] C:\Users\Wolfgang Hxxxx\desktop\Internet Explorer.lnk



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\Users\Wolfgang Hxxxx\AppData\Roaming\babsolution"
Successfully deleted: [Folder] "C:\Users\Wolfgang Hxxxx\AppData\Roaming\babylon"
Successfully deleted: [Folder] "C:\Users\Wolfgang Hxxxx\AppData\Roaming\digitalsite"
Successfully deleted: [Folder] "C:\Users\Wolfgang Hxxxx\AppData\Roaming\media finder"
Failed to delete: [Folder] "C:\Users\Wolfgang Hxxxx\AppData\Roaming\opencandy"



~~~ FireFox

Failed to delete: [File] "C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml"
Failed to delete: [File] "C:\Program Files\Mozilla Firefox\searchplugins\qvo6.xml"
Successfully deleted: [File] C:\Users\Wolfgang Hxxxx\AppData\Roaming\mozilla\firefox\profiles\ycmfar0d.default\user.js
Successfully deleted: [File] C:\Users\Wolfgang Hxxxx\AppData\Roaming\mozilla\firefox\profiles\ycmfar0d.default\invalidprefs.js
Successfully deleted: [File] C:\Users\Wolfgang Hxxxx\AppData\Roaming\mozilla\firefox\profiles\ycmfar0d.default\searchplugins\babylon.xml
Successfully deleted: [File] C:\Users\Wolfgang Hxxxx\AppData\Roaming\mozilla\firefox\profiles\ycmfar0d.default\searchplugins\browserprotect.xml
Successfully deleted: [File] C:\Users\Wolfgang Hxxxx\AppData\Roaming\mozilla\firefox\profiles\ycmfar0d.default\searchplugins\delta.xml
Successfully deleted the following from C:\Users\Wolfgang Hxxxx\AppData\Roaming\mozilla\firefox\profiles\ycmfar0d.default\prefs.js

user_pref("browser.search.defaultenginename", "qvo6");
user_pref("extensions.delta.admin", false);
user_pref("extensions.delta.aflt", "babsst");
user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
user_pref("extensions.delta.autoRvrt", "false");
user_pref("extensions.delta.bbDpng", "20");
user_pref("extensions.delta.cntry", "DE");
user_pref("extensions.delta.dfltLng", "en");
user_pref("extensions.delta.excTlbr", false);
user_pref("extensions.delta.ffxUnstlRst", true);
user_pref("extensions.delta.hdrMd5", "5F687E95DB8D33C537EA99315EFC1A90");
user_pref("extensions.delta.id", "183de1160000000000000050b652542c");
user_pref("extensions.delta.instlDay", "15823");
user_pref("extensions.delta.instlRef", "sst");
user_pref("extensions.delta.lastVrsnTs", "1.8.16.1619:28:00");
user_pref("extensions.delta.newTab", false);
user_pref("extensions.delta.prdct", "delta");
user_pref("extensions.delta.prtnrId", "delta");
user_pref("extensions.delta.rvrt", "false");
user_pref("extensions.delta.sg", "tzb");
user_pref("extensions.delta.smplGrp", "none");
user_pref("extensions.delta.tlbrId", "base");
user_pref("extensions.delta.tlbrSrchUrl", "");
user_pref("extensions.delta.vrsn", "1.8.16.16");
user_pref("extensions.delta.vrsnTs", "1.8.16.1619:28:00");
user_pref("extensions.delta.vrsni", "1.8.16.16");
Emptied folder: C:\Users\Wolfgang Hxxxx\AppData\Roaming\mozilla\firefox\profiles\ycmfar0d.default\minidumps [2 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Wolfgang Hxxxx\appdata\local\Google\Chrome\User Data\Default\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.10.2013 at 17:08:34,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Was ist jetzt noch zu tun?

t'john 06.10.2013 18:11
Sehr gut! :daumenhoc



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




danach:

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

wolly0209 07.10.2013 06:22
Guten Morgen,

ESET hat einige Stunden gebraucht, daher die Logfiles erst jetzt:

ESET Logfile:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ebb3ec86e60bbb4a80d2fcb62cdb6cbe
# engine=15380
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-06 11:04:15
# local_time=2013-10-07 01:04:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 33223 151771960 14645 0
# compatibility_mode=5893 16776574 100 94 7610799 132731846 0 0
# scanned=781921
# found=35
# cleaned=0
# scan_time=19566
sh=8A62D975000A557E19C45A7D7BBEDA729788F776 ft=0 fh=0000000000000000 vn="HTML/Hoax.FastDownload.C.Gen application" ac=I fn="C:\Documents and Settings\Jutta\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3GFK3MA\firstload_com[1].htm"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\AppData\Local\Anwendungsdaten\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\AppData\Local\Anwendungsdaten\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\AppData\Local\Anwendungsdaten\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\AppData\Local\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\AppData\Local\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=F9E670EB5A1FA9F00AB7A3BE838680A77260FE0B ft=0 fh=0000000000000000 vn="probably a variant of Java/Exploit.Agent.NMS trojan" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\4ffec693-1be70d6d"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\Lokale Einstellungen\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\Lokale Einstellungen\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Documents and Settings\Wolfgang Hxxxx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=8A62D975000A557E19C45A7D7BBEDA729788F776 ft=0 fh=0000000000000000 vn="HTML/Hoax.FastDownload.C.Gen application" ac=I fn="C:\Dokumente und Einstellungen\Jutta\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3GFK3MA\firstload_com[1].htm"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\AppData\Local\Anwendungsdaten\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\AppData\Local\Anwendungsdaten\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\AppData\Local\Anwendungsdaten\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\AppData\Local\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\AppData\Local\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=F9E670EB5A1FA9F00AB7A3BE838680A77260FE0B ft=0 fh=0000000000000000 vn="probably a variant of Java/Exploit.Agent.NMS trojan" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\4ffec693-1be70d6d"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\Lokale Einstellungen\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\Lokale Einstellungen\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Dokumente und Einstellungen\Wolfgang Hxxxx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=DEDD2BA972FACDA4CF84F6832B848A31C82FB1F5 ft=1 fh=8d3598336e5d3b57 vn="multiple threats" ac=I fn="C:\FRST\Quarantine\Optimizer_Pro.exe"
sh=D5255F2C3FE7EC8A9066C9E63FF4D990715B8C1F ft=1 fh=ab5463593ca5cf08 vn="probably a variant of Win32/PSW.Agent.BUPXGWL trojan" ac=I fn="C:\Program Files\Free WMA to MP3 Converter\readmedia.dll"
sh=D5255F2C3FE7EC8A9066C9E63FF4D990715B8C1F ft=1 fh=ab5463593ca5cf08 vn="probably a variant of Win32/PSW.Agent.BUPXGWL trojan" ac=I fn="C:\Programme\Free WMA to MP3 Converter\readmedia.dll"
sh=8A62D975000A557E19C45A7D7BBEDA729788F776 ft=0 fh=0000000000000000 vn="HTML/Hoax.FastDownload.C.Gen application" ac=I fn="C:\Users\Jutta\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3GFK3MA\firstload_com[1].htm"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Users\Wolfgang Hxxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Users\Wolfgang Hxxxx\AppData\Local\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Users\Wolfgang Hxxxx\AppData\Local\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=F9E670EB5A1FA9F00AB7A3BE838680A77260FE0B ft=0 fh=0000000000000000 vn="probably a variant of Java/Exploit.Agent.NMS trojan" ac=I fn="C:\Users\Wolfgang Hxxxx\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\4ffec693-1be70d6d"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Users\Wolfgang Hxxxx\Lokale Einstellungen\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3DB6F409AD2C54B3242A4EA2DBAA7A0EF78F43E1 ft=1 fh=e56bd40414fb8fb8 vn="probably a variant of Win32/SpeedingUpMyPC.B application" ac=I fn="C:\Users\Wolfgang Hxxxx\Lokale Einstellungen\Temp\is1590112554\8971192_stp.EXE"
sh=99671F0824900B07E0932702604A6C4E1CAC8A5B ft=1 fh=8a0ca06ba9d3309a vn="a variant of Win32/Adware.MediaFinder.F application" ac=I fn="C:\Users\Wolfgang Hxxxx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\PYCPDVBI\your_file_download.exe"
sh=3128CD4D35E1154B4E179DEE8C1460608076F7ED ft=1 fh=20b11a565bc0ed24 vn="probably a variant of Win32/PSW.Agent.BUPXGWL trojan" ac=I fn="D:\Sicherung\Wolfgang\Eigene Dateien\Sicherung\Software\Updates\Multimedia\MP3 oder CD\free-wma-mp3-converter.exe"
sh=26DC58B1798A3301FF8FA0DFA5A38E1F56B4E9CE ft=0 fh=0000000000000000 vn="JS/Agent.NCA trojan" ac=I fn="G:\Eigene Dateien\Musik\MP3\_Sampler\Zusammenstellungen\Hitparaden\Billboard hot 100 singles & tracks year end charts\1957 - uv\Billboard top 100 - 1957.htm"
und die Checkup:

Code:
Results of screen317's Security Check version 0.99.74 
 Windows 7 Service Pack 1 x86 (UAC is enabled) 
 Internet Explorer 10 
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials 
Avira Desktop                 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 17 
 Java SE Development Kit 7 Update 10
 Java version out of Date!
 Adobe Flash Player        11.8.800.168 
 Adobe Reader 10.1.8 Adobe Reader out of Date! 
 Mozilla Firefox 21.0 Firefox out of Date! 
 Google Chrome 29.0.1547.76 
 Google Chrome 30.0.1599.69 
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Die ältere Java-Version wird benötigt, um auf einen "Sun-Secure-Desktop" zugreifen zu können. Mit den neuen Versionen funktioniert das leider nicht. Das hat meine System-EDV im Büro mir so mitgeteilt, da bei einer/der neuesten Version ein Zugriff von zu Hause auf das Netzwerk im Büro nicht möglich ist.
Kann ich das Java-SE-Development -Kit 7 Update 10 eigentlich löschen. Ich hatte das mal installiert, um auf ein Smartphone zugreifen zu können.

freundlicher Gruß
wolly0209

t'john 07.10.2013 09:00
Zitat:
Die ältere Java-Version wird benötigt, um auf einen "Sun-Secure-Desktop" zugreifen zu können. Mit den neuen Versionen funktioniert das leider nicht. Das hat meine System-EDV im Büro mir so mitgeteilt, da bei einer/der neuesten Version ein Zugriff von zu Hause auf das Netzwerk im Büro nicht möglich ist.
Die alte Version hat natuerlich viele Luecken.

Du solltest mit diesem Rechner keine 'zwielichtigen' :) seiten besuchen.

Zitat:
Kann ich das Java-SE-Development -Kit 7 Update 10 eigentlich löschen. Ich hatte das mal installiert, um auf ein Smartphone zugreifen zu können.
Klar, wenn du es nicht mehr benoetigst.



Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)


Tool-Bereinigung
Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.






Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
http://www.trojaner-board.de/109844-...ren-seite.html
PC wird immer langsamer - was tun?

wolly0209 07.10.2013 17:15
Hallo t'john,

vielen Dank für die kompetente Hilfe.

Eine Spende werde ich Euch zukommen lassen.

"Hoffentlich nicht bis bald!"

Grüße
wolly0209

t'john 07.10.2013 18:09
Vielen Dank :)

wir wuenschen eine virenfreie Zeit ;)


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:43 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131