Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware (https://www.trojaner-board.de/146348-mwb-fund-trojan-inject-trojan-ransomware-spyware.html)

beatric 19.12.2013 23:54
MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware
 
Hallo Zusammen,
schonmal vorweg ich habe keine Ahnung von Computern,erst recht nicht von Virenbekämpfung=)
Ich habe seit Sonntag jedesmal wenn ich den Computer angemacht habe von windows die Meldung bekommen "für entfernen bösartiger Elemente ist ihre Zustimmung erforderlich"hatte die
Wahl zwischen weiter und abbrechen, da ich dahinter nichts vermutet habe, habe ich regelmäßig auf abbrechen gedrückt. Heute habe ich, da es mir doch komisch vorkam auf Anraten eines Bekannten einen Quick scan mit malewarebytes und anschließend mit dem eset online scanner durchgeführt. Malewarebytes scan hat 5 Bedrohungen gefunden, die ich anschließend hab entfernen lassen. Anbei das log dazu:
Code:
Infizierte Dateien: 5
C:\Users\BEKS\AppData\Local\Temp\tmp5c6024c5.exe (Trojan.Inject.RRE) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\BEKS\AppData\Local\Temp\tmp6fd178f3\74447921453.exe (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\BEKS\AppData\Local\Temp\tmp014bfd1a\6389005.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\BEKS\AppData\Local\Temp\tmp049789b5\09899886442.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\BEKS\AppData\Local\Temp\tmp1060b1fa\987686554.exe (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Nach einem kompletten System scan wurden keine bedrohungen mehr gefunden und auch der online scanner von eset konnte nichts auffinden.
Ich hab das gefühl das das noch nicht alles war und würde mich darüber freuen wenn ihr mir sagen könntet ob ich meinen computer wieder gefahrlos nutzen kann oder ob ein Virenbefall noch vorliegt.
Vielen dank schonmal!!

cosinus 20.12.2013 01:07
Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

beatric 20.12.2013 16:37
Hallo vielen dank für deine schnelle Antwort,
weitere Scans als mit Malewarebytes und Eset habe ich nicht durchgeführt.
Der Eset Scan und die Malewareanalyse konnten keine weiteren Bedrohungen feststellen.
Hiereinmal die FRST.txt


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-12-2013 02
Ran by BEKS (administrator) on -BEKS- on 20-12-2013 16:21:40
Running from C:\Users\BEKS\Pictures\2013-11-28 ebay
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Acer Inc.) C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE
(Microsoft Corporation) C:\Windows\System32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [Uvhil] - C:\Users\BEKS\AppData\Roaming\Fecyu\byva.exe
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [Uvhil] - C:\Users\Gast\AppData\Roaming\Fecyu\byva.exe
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVSV5&o=15012&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U9&apn_dtid=&apn_uid=BB23562A-B194-4B5E-9562-F71FE3D1B307&apn_sauid=89A19DDF-2957-4EA3-BD6B-576FD972CA2C
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-20 16:20 - 2007-10-23 17:15 - 01551251 _____ C:\Windows\WindowsUpdate.log
2013-12-20 16:17 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-20 16:17 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-20 16:16 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-20 06:37 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-19 23:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 20:00 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:47 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Fecyu
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-20 16:22

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---


und die addition.txt:

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-12-2013 02
Ran by BEKS at 2013-12-20 16:22:16
Running from C:\Users\BEKS\Pictures\2013-11-28 ebay
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

AAVUpdateManager (Version: 15.00.0000)
Acer Arcade Deluxe (Version: 1.12.4324)
Acer Empowering Technology (Version: 2.5.4006)
Acer eNet Management (Version: 2.6.4007)
Acer ePower Management (Version: 2.5.4014)
Acer ePresentation Management (Version: 2.5.4002)
Acer eSettings Management (Version: 2.5.4008)
Acer GridVista (Version: 2.68.622)
Acer Mobility Center Plug-In (Version: 1.0.3003)
Acer ScreenSaver (Version: 1.11.20070515)
Acer Tour (Version: 2.0.1003)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe AIR (Version: 2.0.3.13070)
Adobe Flash Player 11 Plugin (Version: 11.9.900.170)
Adobe Flash Player ActiveX (Version: 9.0.124.0)
Adobe Reader 8.3.1 (Version: 8.3.1)
ALPS Touch Pad Driver
Ask Toolbar (Version: 1.9.1.0) <==== ATTENTION
Autostart-Manager (Version: 6.02.0000)
AVM FRITZ!Box Dokumentation
AVM FRITZ!Box Druckeranschluss
Big Kahuna Reef 2
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon Kurzwahlprogramm
Canon MP Navigator EX 3.1
Canon MX340 series Benutzerregistrierung
Canon MX340 series MP Drivers
Canon Utilities Easy-PhotoPrint EX
Canon Utilities My Printer
Canon Utilities Solution Menu
CCleaner (Version: 4.05)
CDDRV_Installer (Version: 4.20)
Defraggler (Version: 2.01)
Dynasty
ESET Online Scanner v3
Free DVD Video Burner version 1.2
Free Video to DVD Converter version 1.2
Free YouTube to MP3 Converter version 3.11.17.319 (Version: 3.11.17.319)
Galapago
HDAUDIO Soft Data Fax Modem with SmartCP
Intel(R) Graphics Media Accelerator Driver
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Java(TM) 6 Update 2 (Version: 1.6.0.20)
Java(TM) 6 Update 29 (Version: 6.0.290)
Java(TM) 6 Update 3 (Version: 1.6.0.30)
KhalInstallWrapper (Version: 4.20.129)
Launch Manager
LightScribe  1.4.142.1 (Version: 1.4.142.1)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Works (Version: 08.05.0822)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
NTI Backup NOW! 4.7 (Version: 1.00.0000)
NTI CD & DVD-Maker (Version: 7)
OpenOffice.org 3.3 (Version: 3.3.9567)
Opera 12.16 (Version: 12.16.1860)
PC Connectivity Solution (Version: 8.15.0.0)
PowerProducer 3.72 (Version: 074117(3.7)_Vista_Acer)
Rossmann Fotowelt Software 4.12.1 (Version: 4.12.1)
SAMSUNG Mobile Composite Device Software
Samsung Mobile Modem Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio (Version: 1.00.0000)
SAMSUNG USB Mobile Device Software
SamsungConnectivityCableDriver (Version: 6.83.6.2.1)
Steuer-Sparer 2011 (Version: 16.10)
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Office 2007 (KB934528)
Update for Office System 2007 Setup (KB929722)
VideoLAN VLC media player 0.8.6d (Version: 0.8.6d)
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (Version: 10/12/2007 6.85.4.0)
Yahoo! Toolbar

==================== Restore Points  =========================

11-11-2013 09:42:24 Windows Update
12-11-2013 08:58:28 Windows Update
15-11-2013 18:35:32 Windows Update
15-11-2013 18:43:16 Windows Update
21-11-2013 18:58:05 Windows Update
26-11-2013 17:31:56 Windows Update
29-11-2013 16:36:06 Windows Update
03-12-2013 20:06:00 Windows Update
07-12-2013 05:39:13 Windows Update
13-12-2013 05:46:53 Windows Update
15-12-2013 11:02:22 Windows Update
17-12-2013 14:03:15 Windows Update

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1            localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2006-11-02] (Microsoft Corporation)
Task: {60B4DD79-F219-4A4D-AEA7-08452099A60A} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2010-09-28] ()
Task: {9EB44560-63F6-4CA3-8294-048D3F7D340B} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {B146E4EB-5B20-4D85-AF7E-85B61C7CEE60} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)
Task: {B5F955AA-F7D6-4754-AAE4-042FE8A67421} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-13] (Adobe Systems Incorporated)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2006-11-02] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2007-07-27 18:16 - 2007-02-07 08:25 - 00208896 _____ () C:\Acer\Empowering Technology\EPOWER\SysHook.dll
2007-07-28 01:28 - 2003-06-07 06:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2011-01-17 16:19 - 2011-02-13 13:31 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2007-07-27 18:13 - 2007-04-25 10:35 - 00057344 _____ () C:\Acer\Empowering Technology\Acer.Empowering.Framework.DialogManager.dll
2007-07-27 18:13 - 2007-04-25 10:35 - 00024576 _____ () C:\Acer\Empowering Technology\Acer.Empowering.Framework.PasswordSetting.dll
2007-07-27 18:18 - 2007-04-11 15:42 - 00307200 _____ () C:\Acer\Empowering Technology\ePresentation\ePresentationCTL.dll
2007-07-27 18:18 - 2007-04-11 14:07 - 00077824 _____ () C:\Acer\Empowering Technology\ePresentation\de\ePresentationCTL.resources.dll
2007-10-23 17:29 - 2007-02-13 05:26 - 00016384 _____ () C:\Acer\Empowering Technology\eRecovery\ServiceInterface.dll
2007-07-27 18:14 - 2007-05-10 13:05 - 00028672 _____ () C:\Acer\Empowering Technology\eSettings\eSettings.Plugin.dll
2007-07-27 18:14 - 2007-05-10 13:05 - 00032768 _____ () C:\Acer\Empowering Technology\eSettings.Model.ComputerInterfaces.dll
2007-07-27 18:14 - 2007-05-10 13:05 - 00983040 _____ () C:\Acer\Empowering Technology\eSettings\eSettings.View.dll
2007-07-27 18:14 - 2007-05-10 13:05 - 00143360 _____ () C:\Acer\Empowering Technology\eSettings\eSettings.Presenter.dll
2007-07-27 18:19 - 2007-05-22 14:00 - 00249856 _____ () C:\Acer\Empowering Technology\eNet\eNetPlugin.dll
2007-07-27 18:14 - 2007-05-10 13:05 - 00003584 _____ () C:\Acer\Empowering Technology\eSettings\de\eSettings.Plugin.resources.dll
2007-07-27 18:14 - 2007-05-10 13:05 - 00010752 _____ () C:\Acer\Empowering Technology\eSettings\de\eSettings.Presenter.resources.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:F3176E45

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/20/2013 04:17:04 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/20/2013 06:31:23 AM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/19/2013 07:55:13 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/19/2013 07:42:06 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/19/2013 05:26:09 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/19/2013 10:21:02 AM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/18/2013 08:17:36 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/17/2013 09:06:09 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/17/2013 02:57:53 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.

Error: (12/16/2013 08:58:39 PM) (Source: WerSvc) (User: )
Description: Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.


System errors:
=============
Error: (11/12/2013 10:38:33 AM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (10/20/2013 10:33:57 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80004005

Error: (10/20/2013 10:33:57 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x8007045b

Error: (10/20/2013 10:19:16 AM) (Source: WinDefend) (User: )
Description: Beim Laden der Signaturen wurde von %%%82527 ein Fehler festgestellt. Es wird versucht, einen als gültig bekannten Signatursatz wiederherzustellen.

        Versuchte Signaturen: %%%82524

        Fehlercode: 0x8050a001

        Fehlerbeschreibung: Das Programm kann keine Definitionsdateien finden, die dazu dienen, unerwünschte Software zu erkennen. Überprüfen Sie, ob aktualisierte Definitionsdateien vorhanden sind, und versuchen Sie es dann erneut. Weitere Informationen zum Installieren von Updates finden Sie unter "Hilfe und Support".

        Ladende Signaturen: %%825

        Ladene Signaturversion: 1.159.2215.0

        Ladende Modulversion: %%%825270

Error: (10/19/2013 10:06:06 AM) (Source: Print) (User: -BEKS-)
Description: Das Dokument Rechnung 009Kundrat.wps im Besitz von BEKS konnte nicht auf dem Drucker Canon MX340 series Printer gedruckt werden. Versuchen Sie erneut, das Dokument zu drucken, oder starten Sie den Druckspooler erneut.
Datentyp: NT EMF 1.008. Größe der Spooldatei in Bytes: 31952. Anzahl der gedruckten Bytes: 29360. Gesamtanzahl der Seiten des Dokuments: 2. Anzahl der gedruckten Seiten: 0. Clientcomputer: \\-BEKS-. Vom Druckprozessor zurückgegebener Win32-Fehlercode: Rechnung 009Kundrat.wps0. Rechnung 009Kundrat.wps1

Error: (10/16/2013 09:21:13 AM) (Source: DCOM) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}

Error: (10/16/2013 08:27:21 AM) (Source: Service Control Manager) (User: )
Description: ePower Service1

Error: (09/10/2013 08:35:48 AM) (Source: DCOM) (User: )
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}

Error: (09/10/2013 08:25:34 AM) (Source: Service Control Manager) (User: )
Description: 30000Netman

Error: (09/08/2013 08:48:21 PM) (Source: Print) (User: -BEKS-)
Description: Das Dokument Angebot 004 milz.wps im Besitz von BEKS konnte nicht auf dem Drucker Canon MX340 series Printer gedruckt werden. Versuchen Sie erneut, das Dokument zu drucken, oder starten Sie den Druckspooler erneut.
Datentyp: NT EMF 1.008. Größe der Spooldatei in Bytes: 38020. Anzahl der gedruckten Bytes: 34908. Gesamtanzahl der Seiten des Dokuments: 2. Anzahl der gedruckten Seiten: 0. Clientcomputer: \\-BEKS-. Vom Druckprozessor zurückgegebener Win32-Fehlercode: Angebot 004 milz.wps0. Angebot 004 milz.wps1


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-01-26 19:05:01.035
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-25 08:40:25.078
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-24 15:08:56.622
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-24 09:04:11.642
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-22 19:13:20.191
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-21 11:50:12.615
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-18 08:39:16.241
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-17 09:24:36.497
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-17 09:11:52.236
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-14 12:42:51.353
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\eNetHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 48%
Total physical RAM: 2037.4 MB
Available physical RAM: 1048.97 MB
Total Pagefile: 4292.79 MB
Available Pagefile: 3078.04 MB
Total Virtual: 2047.88 MB
Available Virtual: 1906.7 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:69.77 GB) (Free:13.89 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:69.52 GB) (Free:69.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: 5F2C18D1)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=70 GB) - (Type=06)
Partition 3: (Not Active) - (Size=70 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Vielen Dank schonmal im voraus für weitere Hilfe!!=)

cosinus 20.12.2013 23:52
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\Gast\...\Run: [Uvhil] - C:\Users\Gast\AppData\Roaming\Fecyu\byva.exe
C:\Users\Gast\AppData\Roaming\Fecyu

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Anschließend bitte:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

beatric 21.12.2013 10:58
Nach dem Neustart konnte ich die Fixlog.txt nicht mehr finden,daher habe ich nochmal einen scan durchgeführt.

Ich hoffe das hilft weiter:
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-12-2013 02
Ran by BEKS (administrator) on -BEKS- on 21-12-2013 10:47:33
Running from C:\Users\BEKS\Desktop
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Opera Software) C:\Program Files\Opera\opera.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [Uvhil] - C:\Users\BEKS\AppData\Roaming\Fecyu\byva.exe
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVSV5&o=15012&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U9&apn_dtid=&apn_uid=BB23562A-B194-4B5E-9562-F71FE3D1B307&apn_sauid=89A19DDF-2957-4EA3-BD6B-576FD972CA2C
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-21 10:47 - 2013-12-21 10:47 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-20 16:20 - 2013-12-21 09:17 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-21 10:47 - 2013-12-21 10:47 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 10:08 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-21 10:08 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-21 09:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-21 09:17 - 2013-12-20 16:20 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-21 09:13 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 09:12 - 2007-10-23 17:15 - 01592799 _____ C:\Windows\WindowsUpdate.log
2013-12-21 09:08 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-21 07:06 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:47 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Fecyu
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-21 09:14

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---




Der Rootkitscan konnte nichts finden:

Code:
Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org

Database version: v2013.12.21.02

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.17037
BEKS :: -BEKS- [administrator]

21.12.2013 09:55:03
mbar-log-2013-12-21 (09-55-03).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 226414
Time elapsed: 10 minute(s), 46 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Das ist doch positiv,oder?=)

cosinus 21.12.2013 16:28
Nein, das neue Log zeigt immer noch was an. Fix wiederholen.

beatric 21.12.2013 20:58
Hallo =), meinst du diesen Fix?



Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-12-2013 02
Ran by BEKS at 2013-12-21 20:50:52 Run:2
Running from C:\Users\BEKS\Desktop
Boot Mode: Normal

==============================================
Content of fixlist:
*****************
HKU\Gast\...\Run: [Uvhil] - C:\Users\Gast\AppData\Roaming\Fecyu\byva.exe
C:\Users\Gast\AppData\Roaming\Fecyu
       
*****************

HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\Uvhil => Value not found.
"C:\Users\Gast\AppData\Roaming\Fecyu" => File/Directory not found.

==== End of Fixlog ====

Hier der neue scan

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-12-2013 02
Ran by BEKS (administrator) on -BEKS- on 21-12-2013 21:20:37
Running from C:\Users\BEKS\Desktop
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [Uvhil] - C:\Users\BEKS\AppData\Roaming\Fecyu\byva.exe
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVSV5&o=15012&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U9&apn_dtid=&apn_uid=BB23562A-B194-4B5E-9562-F71FE3D1B307&apn_sauid=89A19DDF-2957-4EA3-BD6B-576FD972CA2C
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-21 10:47 - 2013-12-21 21:20 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-20 16:20 - 2013-12-21 09:17 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-21 21:20 - 2013-12-21 10:47 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 20:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-21 20:42 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 20:40 - 2007-10-23 17:15 - 01600677 _____ C:\Windows\WindowsUpdate.log
2013-12-21 20:36 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-21 20:36 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-21 20:35 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-21 15:16 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-21 09:17 - 2013-12-20 16:20 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:47 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Fecyu
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-21 20:42

==================== End Of Log ============================
--- --- ---

--- --- ---
Danke nochmal für die Zeit die du investierst.

cosinus 21.12.2013 21:22
FRST neu runterladen und neues Log machen

beatric 21.12.2013 22:03
So alles gemacht=)

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-12-2013 02
Ran by BEKS at 2013-12-21 21:57:50 Run:3
Running from C:\Users\BEKS\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\Gast\...\Run: [Uvhil] - C:\Users\Gast\AppData\Roaming\Fecyu\byva.exe
C:\Users\Gast\AppData\Roaming\Fecyu
       
*****************

HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\Uvhil => Value not found.
"C:\Users\Gast\AppData\Roaming\Fecyu" => File/Directory not found.

==== End of Fixlog ====

Der neue Scan:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-12-2013 02
Ran by BEKS (administrator) on -BEKS- on 21-12-2013 22:00:05
Running from C:\Users\BEKS\Desktop
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Opera Software) C:\Program Files\Opera\opera.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [Uvhil] - C:\Users\BEKS\AppData\Roaming\Fecyu\byva.exe
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVSV5&o=15012&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U9&apn_dtid=&apn_uid=BB23562A-B194-4B5E-9562-F71FE3D1B307&apn_sauid=89A19DDF-2957-4EA3-BD6B-576FD972CA2C
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-21 21:52 - 2013-12-21 21:52 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-21 10:47 - 2013-12-21 22:00 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-21 22:00 - 2013-12-21 10:47 - 00011247 _____ C:\Users\BEKS\Desktop\FRST.txt
2013-12-21 21:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-21 21:52 - 2013-12-21 21:52 - 01325858 _____ (Farbar) C:\Users\BEKS\Desktop\FRST.exe
2013-12-21 21:50 - 2007-10-23 17:15 - 01600859 _____ C:\Windows\WindowsUpdate.log
2013-12-21 21:36 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-21 21:36 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-21 20:42 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-21 20:35 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-21 15:16 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:47 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Fecyu
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-21 20:42

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---

cosinus 22.12.2013 22:25
Irgendwas geht da kräftig in die Hose :(
Entweder machst du den Fix falsch oder du hast noch irgendeinen Virenscanner an, der das Fixen unterbindet.

beatric 23.12.2013 17:40
So ein Bekannter hat sich über Teamviewer nochmal angeschaut, warum da der Fix nicht funktioniert und dann die Kommandozeilen etwas umgeschrieben hier die dazu ausgespuckten Fixlogs:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-12-2013 01
Ran by BEKS at 2013-12-23 17:04:47 Run:6
Running from C:\Users\BEKS\Desktop\frst
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\Gast\...\Run: [Uvhil] - C:\Users\BEKS\AppData\Roaming\Fecyu\byva.exe
C:\Users\BEKS\AppData\Roaming\Fecyu
*****************

HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\Uvhil => Value not found.
C:\Users\BEKS\AppData\Roaming\Fecyu => Moved successfully.

==== End of Fixlog ====
Da der erste Wert ja auch dann nicht gefunden wurde, hat er auch die erste Zeile angepasst mit diesem Fixlog:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-12-2013 01
Ran by BEKS at 2013-12-23 17:26:34 Run:9
Running from C:\Users\BEKS\Desktop\frst
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKCU\...\Run: [Uvhil] - C:\Users\BEKS\AppData\Roaming\Fecyu\byva.exe
C:\Users\BEKS\AppData\Roaming\Fecyu
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Uvhil => Value deleted successfully.
"C:\Users\BEKS\AppData\Roaming\Fecyu" => File/Directory not found.

==== End of Fixlog ====
Im Anschluss noch der neue Scan :


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2013 01
Ran by BEKS (administrator) on -BEKS- on 23-12-2013 17:27:25
Running from C:\Users\BEKS\Desktop\frst
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Desktop.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVSV5&o=15012&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U9&apn_dtid=&apn_uid=BB23562A-B194-4B5E-9562-F71FE3D1B307&apn_sauid=89A19DDF-2957-4EA3-BD6B-576FD972CA2C
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-23 17:02 - 2013-12-23 17:27 - 00000000 ____D C:\Users\BEKS\Desktop\frst
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-21 10:47 - 2013-12-21 22:00 - 00016473 _____ C:\Users\BEKS\Desktop\FRSTvorher.txt
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-23 17:27 - 2013-12-23 17:02 - 00000000 ____D C:\Users\BEKS\Desktop\frst
2013-12-23 16:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-23 16:53 - 2007-11-27 20:03 - 00076808 _____ C:\Users\BEKS\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-23 16:47 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-23 16:45 - 2007-10-23 17:15 - 01636781 _____ C:\Windows\WindowsUpdate.log
2013-12-23 16:40 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-23 16:40 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-23 16:40 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-23 06:34 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-21 22:00 - 2013-12-21 10:47 - 00016473 _____ C:\Users\BEKS\Desktop\FRSTvorher.txt
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\Desktop\mbar-1.07
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-23 16:46

==================== End Of Log ============================
--- --- ---

--- --- ---


So ich hoffe das die Umschreibungen in Ordnung waren, kannste ja mal anschauen obs jetzt geht :daumenhoc

cosinus 23.12.2013 17:57
Wieso stand denn da Gast als Username :confused:

Egal

Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


beatric 23.12.2013 22:54
So bitteschön:

Der Scan mit dem adwCleaner:

AdwCleaner Logfile:
Code:
# AdwCleaner v3.016 - Bericht erstellt am 23/12/2013 um 20:05:25
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium  (32 bits)
# Benutzername : BEKS - -BEKS-
# Gestartet von : C:\Users\BEKS\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files\Ask.com
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\BEKS\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\BEKS\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\BEKS\AppData\Roaming\iWin
Ordner Gelöscht : C:\Users\Gast\AppData\LocalLow\AskToolbar
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{60B4DD79-F219-4A4D-AEA7-08452099A60A}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{60B4DD79-F219-4A4D-AEA7-08452099A60A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AppDataLow\AskBarDis
Schlüssel Gelöscht : HKCU\Software\AppDataLow\AskToolbarInfo
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9

***** [ Browser ] *****

-\\ Internet Explorer v7.0.6000.17037


*************************

AdwCleaner[R0].txt - [6809 octets] - [23/12/2013 20:00:45]
AdwCleaner[S0].txt - [6760 octets] - [23/12/2013 20:05:25]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6820 octets] ##########
--- --- ---

[/code]

Das Log von Junkware:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by BEKS on 23.12.2013 at 20:12:05,68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.12.2013 at 20:18:21,43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Und der neue Scan mit FRST:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2013 01
Ran by BEKS (administrator) on -BEKS- on 23-12-2013 21:43:46
Running from C:\Users\BEKS\Desktop\VirEntfernung\frst
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Desktop.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Acer Inc.) C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-23 20:18 - 2013-12-23 20:18 - 00000926 _____ C:\Users\BEKS\Desktop\JRT.txt
2013-12-23 20:12 - 2013-12-23 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 20:00 - 2013-12-23 20:05 - 00000000 ____D C:\AdwCleaner
2013-12-23 19:58 - 2013-12-23 21:43 - 00000000 ____D C:\Users\BEKS\Desktop\VirEntfernung
2013-12-23 19:58 - 2013-12-23 19:58 - 01034531 _____ (Thisisu) C:\Users\BEKS\Desktop\JRT.exe
2013-12-23 19:57 - 2013-12-23 19:57 - 01233962 _____ C:\Users\BEKS\Desktop\adwcleaner.exe
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-23 21:43 - 2013-12-23 19:58 - 00000000 ____D C:\Users\BEKS\Desktop\VirEntfernung
2013-12-23 21:07 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-23 21:07 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-23 20:59 - 2007-10-23 17:15 - 01738521 _____ C:\Windows\WindowsUpdate.log
2013-12-23 20:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-23 20:18 - 2013-12-23 20:18 - 00000926 _____ C:\Users\BEKS\Desktop\JRT.txt
2013-12-23 20:15 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-23 20:12 - 2013-12-23 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 20:07 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-23 20:07 - 2006-11-02 13:47 - 00322712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-23 20:06 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-23 20:05 - 2013-12-23 20:00 - 00000000 ____D C:\AdwCleaner
2013-12-23 20:05 - 2009-09-16 16:03 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-12-23 19:58 - 2013-12-23 19:58 - 01034531 _____ (Thisisu) C:\Users\BEKS\Desktop\JRT.exe
2013-12-23 19:57 - 2013-12-23 19:57 - 01233962 _____ C:\Users\BEKS\Desktop\adwcleaner.exe
2013-12-23 16:53 - 2007-11-27 20:03 - 00076808 _____ C:\Users\BEKS\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:
====================
C:\Users\BEKS\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-23 20:14

==================== End Of Log ============================
--- --- ---

--- --- ---


Ich wünsche an der Stelle schonmal Frohe Weihnachten und bedanke mich nochmals! =)

cosinus 23.12.2013 23:56
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
C:\Users\Gast\AppData\Roaming\*.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


beatric 24.12.2013 15:30
Der Fix hat irgendwie auch nicht so ganz geklappt.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-12-2013 01
Ran by BEKS at 2013-12-24 13:25:10 Run:10
Running from C:\Users\BEKS\Desktop\VirEntfernung\frst
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
C:\Users\Gast\AppData\Roaming\*.exe
       
*****************

HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\IExplorer Util => Value deleted successfully.
"C:\Users\Gast\AppData\Roaming\*.exe" => File/Directory not found.

==== End of Fixlog ====
Die zweite Zeile wurde auch in allen möglichen Varianten noch ausgetestet, aber
FRST konnte die Datei irgendwie nicht auffinden.

Neuer Scan:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2013 01
Ran by BEKS (administrator) on -BEKS- on 24-12-2013 13:59:52
Running from C:\Users\BEKS\Desktop\VirEntfernung\frst
Microsoft® Windows Vista™ Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Desktop.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)

==================== Drivers (Whitelisted) ====================

R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-24 13:47 - 2013-12-24 13:47 - 00000000 _____ C:\Users\BEKS\Desktop\Antwort kopieren.txt
2013-12-23 20:12 - 2013-12-23 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 20:00 - 2013-12-23 20:05 - 00000000 ____D C:\AdwCleaner
2013-12-23 19:58 - 2013-12-24 13:14 - 00000000 ____D C:\Users\BEKS\Desktop\VirEntfernung
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET

==================== One Month Modified Files and Folders =======

2013-12-24 13:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-24 13:47 - 2013-12-24 13:47 - 00000000 _____ C:\Users\BEKS\Desktop\Antwort kopieren.txt
2013-12-24 13:18 - 2007-10-23 17:15 - 01819515 _____ C:\Windows\WindowsUpdate.log
2013-12-24 13:14 - 2013-12-23 19:58 - 00000000 ____D C:\Users\BEKS\Desktop\VirEntfernung
2013-12-24 13:14 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 13:07 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-24 13:07 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-24 13:06 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-23 22:57 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-23 20:12 - 2013-12-23 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 20:07 - 2006-11-02 13:47 - 00322712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-23 20:05 - 2013-12-23 20:00 - 00000000 ____D C:\AdwCleaner
2013-12-23 20:05 - 2009-09-16 16:03 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-12-23 16:53 - 2007-11-27 20:03 - 00076808 _____ C:\Users\BEKS\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:
====================
C:\Users\BEKS\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-24 13:13

==================== End Of Log ============================
--- --- ---

--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:59 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19