Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   firefox-addon VIS 1.01 - trojaner eingefangen ? (https://www.trojaner-board.de/150720-firefox-addon-vis-1-01-trojaner-eingefangen.html)

elagtric 06.03.2014 23:41
firefox-addon VIS 1.01 - trojaner eingefangen ?
 
hallo,die runde

nachdem mit dem CCC nicht so leicht zu kommunizieren ist, möchte ich mein glück? eventuell hier probieren. bin neu hier, hoffe aber halbwegs innerhalb der goldenen regeln zu liegen.
also :
habe mir gestern auf youtube das video eines ziemlich durchgeknallten (neo)nazis angeschaut. ein paar sekunden später meinte mein firefox per popup, ein addon namens VIS 1.01 aus sicherheitsgründen deaktivieren zu müssen. habe zeit meiner internetpräsenz eigentlich nur 4 addon's laufen ( noscript, adblock (plus ) , ghostery & trackmenot ) , jenes "sicherheitsrisiko" also zu 100 % nicht wissentlich installiert. in der allerersten aufregung und nach kurzer suchmaschinen-recherche hab ich dann (leider?) jenes ominöse "VIS 1.01" komplett aus dem firefox entfernt, incl. browserneustart etc. danach sicherheitshalber malwarebytes antimalware laufen lassen, hat auch 7 probleme gefunden, die ich jetzt leider nimmer nachvollziehen kann.
jetzt zum eigentlichen kern des problems, oder den kernen .... :

kann es sein, dass man sich (ohne irgentwelche links zu klicken, also direkt auf youtube.de ) nur durch das anschauen von videos irgendwelche addon's einfangen kann ? das timing war einfach verblüffend. keine anderen programme offen, nur den firefox auf youtube gestartet und plopp : jene sicherheitsmeldung. musste dann leider ins bett und hab heute nochmal via metager & google etc. nach jenem ominösen VIS 1.01 gesucht. der witz : bis auf 2 oder 3 weitere betroffene, die es genauso überrascht hat, scheint das ding nicht zu existieren ! einer hat bei "gutefrage.net" nachgefragt, ein anderer in einem englischsprachigen forum (bleepingcomputer.com). sonst ist da absolut nix weiter zu finden. im zusammenhang, dass das video von einem (mittlerweile wohl weggesperrtem) hardcore-nazi stammt, werde ich das gefühl nicht los, mir da eine abart jenes vieldiskutierten "bundestrojaners" eingefangen zu haben. heute ärgere ich mich fast, dass ich "auf nummer sicher" ging und das teil (hoffentlich?) nicht nur deaktiviert, sondern zur sicherheit gleich entfernt habe. mir will einfach nicht begreiflich werden, dass es bei milliarden von internet-nutzern scheinbar niemanden gibt, der auch nur ungefähre informationen zu jenem heimlichen "einschleicher" hat. einzig firefox (27.0.1) scheint da mehr zu wissen als der rest der welt ....

wem kommt das noch spanisch vor oder wer hat evtl. sachdienliche hinweise bzw. bessere suchmaschinenergebnisse zu "VIS 1.01" ?

mit freundlichen grüssen, th. rohnfeld

schrauber 07.03.2014 07:31
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


elagtric 07.03.2014 13:19
das mit der raute kommt mir zwar irgendwie nicht so gewollt vor, keine ahnung, ob es dann die zwei files automatisch eingefügt hätte. hab es eben manuell plus der raute ( code ) eingefügt.


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-03-2014
Ran by chef (administrator) on WOPR on 07-03-2014 12:59:13
Running from C:\Users\chef\Downloads
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Nitro PDF Software) C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe
(Realtek) C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
(Realtek Semiconductor Corp.) C:\Program Files\oem\11n USB Wireless LAN Utility\RtWlan.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [ccleaner] - C:\Program Files\CCleaner\CCleaner.exe [4324120 2013-11-22] (Piriform Ltd)
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [Spybot-S&D Cleaning] - C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {2419B2B9-996E-419A-B79B-6600D820B370} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3317892&CUI=UN41926036772920014&UM=2
SearchScopes: HKCU - {2C93367C-BA9A-4CA2-B582-4B61404C765D} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {3081A9B6-8DEB-4423-96A2-2177723580C0} URL = hxxp://websearch.ask.com.anonymize-me.de/?anonymto=687474703A2F2F7765627365617263682E61736B2E636F6D2F72656469726563743F636C69656E743D69652674623D4F524A266F3D267372633D6B7726713D7B7365617263685465726D737D266C6F63616C653D2661706E5F70746E72733D55332661706E5F647469643D4F534A303030595944452661706E5F7569643D41343536314143452D424631432D343139372D384639452D3331343039364133324446452661706E5F73617569643D30443832323946312D423632382D343331382D424643342D343235323041463642353131&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {411EA882-929B-449F-9C65-7CEDED8DEDFE} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D26464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {6BF147B5-7A30-4782-B5B9-8C0AA3632EC8} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {80E424A2-185B-4FAE-BA5E-37FBF8B2D48B} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {97132A2A-367E-4E5A-9D73-CB11EA3ECCD8} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {CC2AE24D-3E94-4B16-8A85-7B52A831737B} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default
FF SearchEngineOrder.1: Ask.com
FF Homepage: hxxp://metager.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nitropdf.com/NitroPDF - C:\Program Files\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{4737AE6A-7279-4159-9A93-1D68EF07A0AB}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{5E0C8B97-41A7-45AC-99A0-63C13108F0C4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{7DE05CB2-21C3-4827-A5AB-E6EA049CFEC5}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{9B94CAF1-8947-4C10-9426-D9779C1AD6D4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{BF7F8644-95BE-42CD-98C8-46AF33DA8E0E}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{CFA5FBE2-63F6-4659-AE63-213807DE553A}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NetVideoHunter - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\netvideohunter@netvideohunter.com [2013-12-02]
FF Extension: YouTube Unblocker - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-24]
FF Extension: DownloadHelper - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-27]
FF Extension: Ghostery - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\firefox@ghostery.com.xpi [2013-12-30]
FF Extension: TrackMeNot - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\trackmenot@mrl.nyu.edu.xpi [2012-03-30]
FF Extension: NoScript - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-03-30]
FF Extension: {a3c7fdeb-4acc-4154-b848-8b21ce7dfdee} - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{a3c7fdeb-4acc-4154-b848-8b21ce7dfdee}.xpi [2013-11-02]
FF Extension: Adblock Plus - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-19]
FF Extension: BetterPrivacy - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-04-02]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-12-19] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-03-26] (Nitro PDF Software)
R2 RealtekCU; C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\RpcAgentSrv.exe [95896 2009-03-28] (SiSoftware)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [83984 2012-02-23] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NANMp50; C:\Windows\System32\Drivers\NANMp50.sys [36408 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NANSp50; C:\Windows\System32\Drivers\NANSp50.sys [35384 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\rtwlanu.sys [864360 2011-09-06] (Realtek Semiconductor Corporation                          )
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-05-03] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S1 gfjnxobt; \??\C:\Windows\system32\drivers\gfjnxobt.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 netr28u; system32\DRIVERS\netr28u.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RTL8192su; system32\DRIVERS\RTL8192su.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-07 12:59 - 2014-03-07 12:59 - 00014973 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-07 12:58 - 2014-03-07 12:59 - 00000000 ____D () C:\FRST
2014-03-07 12:56 - 2014-03-07 12:57 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-07 12:25 - 2014-03-07 12:26 - 00003638 _____ () C:\Windows\WindowsUpdate.log
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:54 - 2014-03-05 22:54 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-05 22:53 - 2014-03-05 22:54 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-05 22:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-05 22:50 - 2014-03-05 22:51 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-28 20:09 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-20 18:06 - 2014-02-20 18:07 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-16 21:44 - 2014-02-16 21:45 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-17 16:16 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:37 - 2014-02-16 14:40 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:35 - 2014-02-16 14:36 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-09 06:31 - 2014-02-20 17:43 - 00000000 ____D () C:\Program Files\isohero
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-07 19:32 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-07 19:32 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-07 19:32 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 18:30 - 2014-02-07 18:33 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:57 - 2014-02-07 14:58 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar
2014-02-06 23:25 - 2014-02-06 23:26 - 00000000 ____D () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001
2014-02-06 23:23 - 2014-02-06 23:24 - 06860196 _____ () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001.zip
2014-02-06 23:10 - 2014-02-07 15:02 - 00000000 ____D () C:\DOS
2014-02-06 22:56 - 2014-02-06 22:56 - 00032934 _____ () C:\Users\chef\Downloads\DOSBox-german-lang-0.74.zip
2014-02-06 22:55 - 2014-02-06 23:08 - 00005330 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox.dosbox
2014-02-06 22:53 - 2014-02-06 22:53 - 00005316 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox
2014-02-06 22:50 - 2014-02-06 22:50 - 01846392 _____ () C:\Users\chef\Downloads\Roby03.zip
2014-02-06 22:50 - 2014-02-06 22:50 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-02-06 22:41 - 2014-02-06 22:41 - 00001703 _____ () C:\Users\Public\Desktop\DOSBox 0.74.lnk
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Users\chef\AppData\Local\DOSBox
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Program Files\DOSBox
2014-02-06 22:40 - 2014-02-06 22:41 - 01448809 _____ (DOSBox Team) C:\Users\chef\Downloads\DOSBox0.74-win32-installer.exe
2014-02-06 22:34 - 2014-02-06 22:34 - 00000000 ____D () C:\Users\chef\Downloads\hquest2
2014-02-06 22:33 - 2014-02-06 22:34 - 01826500 _____ () C:\Users\chef\Downloads\hquest2.zip
2014-02-06 22:27 - 2014-02-06 22:27 - 00596689 _____ () C:\Users\chef\Downloads\Hero Quest.zip

==================== One Month Modified Files and Folders =======

2014-03-07 12:59 - 2014-03-07 12:59 - 00014973 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-07 12:59 - 2014-03-07 12:58 - 00000000 ____D () C:\FRST
2014-03-07 12:57 - 2014-03-07 12:56 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-07 12:26 - 2014-03-07 12:25 - 00003638 _____ () C:\Windows\WindowsUpdate.log
2014-03-07 12:23 - 2013-05-13 21:31 - 00000620 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-03-07 12:22 - 2006-11-02 13:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-07 12:22 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-07 12:22 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-07 10:09 - 2006-11-02 13:58 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-06 22:38 - 2012-04-21 21:40 - 00002509 _____ () C:\Users\chef\Desktop\inSSIDer.lnk
2014-03-05 23:21 - 2013-09-08 22:24 - 00000000 ____D () C:\AdwCleaner
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:54 - 2014-03-05 22:54 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-05 22:54 - 2014-03-05 22:53 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-05 22:51 - 2014-03-05 22:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-03-05 22:35 - 2013-12-11 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-01 19:05 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-28 20:23 - 2006-11-02 11:33 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 20:21 - 2013-10-18 12:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-21 16:37 - 2012-03-31 16:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-21 16:37 - 2012-03-31 16:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-20 18:07 - 2014-02-20 18:06 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-20 17:43 - 2014-02-09 06:31 - 00000000 ____D () C:\Program Files\isohero
2014-02-17 16:16 - 2014-02-16 14:40 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 22:37 - 2012-04-26 07:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-16 21:45 - 2014-02-16 21:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:40 - 2014-02-16 14:37 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:36 - 2014-02-16 14:35 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-07 22:35 - 2012-04-16 11:19 - 00000000 ____D () C:\Users\alle anderen\AppData\Local\VirtualStore
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-09 16:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-07 19:32 - 2013-07-04 15:10 - 00000000 ____D () C:\Program Files\Java
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 19:25 - 2013-12-22 19:49 - 00000000 ____D () C:\Users\chef\AppData\Roaming\UFOAI
2014-02-07 18:33 - 2014-02-07 18:30 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:02 - 2014-02-06 23:10 - 00000000 ____D () C:\DOS
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:58 - 2014-02-07 14:57 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar
2014-02-06 23:26 - 2014-02-06 23:25 - 00000000 ____D () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001
2014-02-06 23:24 - 2014-02-06 23:23 - 06860196 _____ () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001.zip
2014-02-06 23:08 - 2014-02-06 22:55 - 00005330 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox.dosbox
2014-02-06 22:56 - 2014-02-06 22:56 - 00032934 _____ () C:\Users\chef\Downloads\DOSBox-german-lang-0.74.zip
2014-02-06 22:53 - 2014-02-06 22:53 - 00005316 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox
2014-02-06 22:50 - 2014-02-06 22:50 - 01846392 _____ () C:\Users\chef\Downloads\Roby03.zip
2014-02-06 22:50 - 2014-02-06 22:50 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-02-06 22:41 - 2014-02-06 22:41 - 00001703 _____ () C:\Users\Public\Desktop\DOSBox 0.74.lnk
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Users\chef\AppData\Local\DOSBox
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Program Files\DOSBox
2014-02-06 22:41 - 2014-02-06 22:40 - 01448809 _____ (DOSBox Team) C:\Users\chef\Downloads\DOSBox0.74-win32-installer.exe
2014-02-06 22:34 - 2014-02-06 22:34 - 00000000 ____D () C:\Users\chef\Downloads\hquest2
2014-02-06 22:34 - 2014-02-06 22:33 - 01826500 _____ () C:\Users\chef\Downloads\hquest2.zip
2014-02-06 22:27 - 2014-02-06 22:27 - 00596689 _____ () C:\Users\chef\Downloads\Hero Quest.zip

Some content of TEMP:
====================
C:\Users\alle anderen\AppData\Local\Temp\avgnt.exe
C:\Users\chef\AppData\Local\Temp\avgnt.exe
C:\Users\Sven\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-07 12:29

==================== End Of Log ============================
--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-03-2014
Ran by chef at 2014-03-07 12:59:39
Running from C:\Users\chef\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{3825F8BD-F784-6FBB-A5CD-857559148007}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
AMD VISION Engine Control Center (Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
ATI AVIVO Codecs (Version: 11.6.0.10524 - ATI Technologies Inc.) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Big Fish: Game Manager (HKLM\...\BFGC) (Version: 3.2.0.7 - )
Catalyst Control Center - Branding (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.08 - Piriform)
Commander (HKLM\...\Commander) (Version:  - )
Daum PotPlayer 1.5.40688 (HKLM\...\PotPlayer) (Version:  - )
File Commander/W (HKLM\...\{4F6B70B1-EFFA-469F-A7B8-94A565C1B31F}) (Version: 2.40 - Brian Havard)
Fizzball (HKLM\...\BFG-Fizzball) (Version:  - )
Free YouTube to MP3 Converter version 3.11.34.1015 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.34.1015 - DVDVideoSoft Ltd.)
FreeCommander 2009.02b (HKLM\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
HydraVision (Version: 4.2.206.0 - ATI Technologies Inc.) Hidden
IceChat 7.70 (Build 20101031) (HKLM\...\IceChat_is1) (Version: 7.70 - IceChat Networks)
inSSIDer (HKLM\...\{BF6379E6-9936-46B0-B6AC-C56EE3987D2E}) (Version: 2.1.1 - MetaGeek)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.4.304.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (HKLM\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MyDefrag v4.3.1 (HKLM\...\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
NetSurveyor 2.0.9686.0 (HKLM\...\NetSurveyor_is1) (Version:  - Nuts About Nets, LLC)
Network Stumbler 0.4.0 (remove only) (HKLM\...\Network Stumbler) (Version:  - )
NirSoft WirelessNetView (HKLM\...\NirSoft WirelessNetView) (Version:  - )
Nitro Reader 3 (HKLM\...\{36A1AA90-FB87-4B29-82F3-B116B0023167}) (Version: 3.5.2.10 - Nitro)
NVIDIA PhysX (HKLM\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Pizza Dude (HKLM\...\Pizza Dude_is1) (Version: 1.0 - MyPlayCity, Inc.)
Ravensburger tiptoi (HKLM\...\Ravensburger tiptoi) (Version:  - )
Revo Uninstaller 1.93 (HKLM\...\Revo Uninstaller) (Version: 1.93 - VS Revo Group)
RK-WLAN-Keygen (HKLM\...\RK-WLAN-Keygen_is1) (Version: 1.4 - Robert Knapp Software)
Sacred 2 - Fallen Angel (HKLM\...\{7D0AEAD8-07FA-4C4D-9347-E7FBC5534B73}) (Version: 2.43.0.0 - Deep Silver)
SiSoftware Sandra Lite 2012.SP3 (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 18.40.2012.5 - SiSoftware)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.0.12 - Safer-Networking Ltd.)
Subsea Relic (HKLM\...\Subsea Relic_is1) (Version: 1.0 - MyPlayCity, Inc.)
SuperTux 0.1.3 (HKLM\...\SuperTux_is1) (Version:  - SuperTux Development Team)
Tiny Youtube Converter 1.6 (HKLM\...\{7B4BB392-8280-496F-A9AF-BC96FEB963EC}) (Version: 1.6 - TYC.com)
Torchlight II (HKLM\...\{55F7D521-17CA-454D-9D4D-975EF2E10708}_is1) (Version:  - White Rabbit Interactive)
Turtle Odyssey 2 (HKLM\...\Turtle Odyssey 2) (Version:  - )
Ultra Defragmenter (HKLM\...\UltraDefrag) (Version: 6.0.2 - UltraDefrag Development Team)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2836939v3) (Version: 3 - Microsoft Corporation)
VIS (HKLM\...\VIS) (Version:  - ) <==== ATTENTION
Vivid Arkanoid (HKLM\...\Vivid Arkanoid_is1) (Version: 1.0 - MyPlayCity, Inc.)
VLC media player 2.1.1 (HKLM\...\VLC media player) (Version: 2.1.1 - VideoLAN)
WinPcap 4.1.2 (HKLM\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinRAR 5.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Wireless LAN Driver and Utility (HKLM\...\{9C049499-055C-4A0C-A916-1D12314F45EB}) (Version: 1.00.0183 - Co.,Ltd.)
Wireshark 1.1.3 (HKLM\...\Wireshark) (Version: 1.1.3 - The Wireshark developer community, hxxp://www.wireshark.org)

==================== Restore Points  =========================

19-02-2014 13:30:01 Geplanter Prüfpunkt
21-02-2014 15:31:28 Windows Update
22-02-2014 14:56:48 Geplanter Prüfpunkt
24-02-2014 11:29:12 Geplanter Prüfpunkt
24-02-2014 21:42:15 Windows Update
28-02-2014 19:12:03 Windows Update
01-03-2014 18:36:06 Geplanter Prüfpunkt
02-03-2014 11:26:28 Geplanter Prüfpunkt
03-03-2014 18:10:33 Geplanter Prüfpunkt
04-03-2014 15:33:44 Windows Update
05-03-2014 11:58:06 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1            localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {18DFD9FC-082E-4E9B-8285-5F21D2B4EDAE} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1B99B735-164A-4B50-A0F4-A6ACDBD2450D} - System32\Tasks\MyDefrag v4.3.1 Monthly => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticMonthly.MyD [2010-05-21] ()
Task: {2D2DEC4F-74BB-4FB5-9626-21B3A60365F1} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {2F2205D4-5436-49A0-892C-2A7E06D950E4} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {48532C1B-0A33-468A-9FD0-7FBD32011A98} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {5916F864-469C-4391-8604-E4EA141A2699} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {5BFA86C4-2A30-44DC-8B26-0CEFD049D8BC} - \WPD\SqmUpload_S-1-5-21-1461220110-1976370169-1414792120-1000 No Task File
Task: {6D8C4D6D-8246-4F4F-90BC-FF9EA222D078} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {747A4083-D19A-46A2-A99D-A3236076DF27} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {82EE28F0-4EEC-4C5D-98B0-62841C6EFAE5} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => C:\Windows\servicing\vsp1ceip.exe [2008-01-18] (Microsoft Corporation)
Task: {84356A22-A76A-4E94-8A8A-4C9AECCC57EC} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {8B0E6FAB-F43A-4988-AF0A-A21646C212F0} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {8E3B76BD-F61C-4784-8077-206C06DE4E8F} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {9348E16E-26B4-4BA3-BA03-5CBA4919B7B5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-21] (Adobe Systems Incorporated)
Task: {9ED703A9-5FFD-40D5-895A-4385EE1509DE} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-18] (Microsoft Corporation)
Task: {C8B3025B-D21E-4527-BBC6-CDFBFEB026E1} - \Microsoft\Windows\Bluetooth\UninstallDeviceTask No Task File
Task: {E3FB5EEC-ADD6-47FB-8628-521C76BC0F59} - System32\Tasks\MyDefrag v4.3.1 Daily => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticDaily.MyD [2010-05-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job.bak => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
Task: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe

==================== Loaded Modules (whitelisted) =============

2013-05-03 17:58 - 2013-05-03 17:50 - 00397704 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2012-12-19 15:31 - 2012-12-19 15:31 - 00065024 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-05-13 21:31 - 2012-11-13 13:06 - 00108960 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-05-13 21:31 - 2012-11-13 13:06 - 00416160 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2013-05-13 21:31 - 2012-11-13 13:06 - 00158624 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-05-13 21:31 - 2012-08-23 08:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
2013-05-13 21:31 - 2012-11-13 13:06 - 00528288 _____ () C:\Program Files\Spybot - Search & Destroy 2\JSDialogPack150.bpl
2013-05-13 21:31 - 2012-11-13 13:06 - 00554400 _____ () C:\Program Files\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
2012-04-06 02:09 - 2012-04-06 02:09 - 00037376 _____ () C:\Windows\system32\atitmpxx.dll
2012-12-27 18:24 - 2009-12-09 21:20 - 00126976 _____ () C:\Program Files\oem\11n USB Wireless LAN Utility\EnumDevLib.dll
2014-02-16 21:44 - 2014-02-16 21:45 - 03578992 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\chef:gs5sys
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F
AlternateDataStreams: C:\ProgramData\TEMP:3BE7E50E
AlternateDataStreams: C:\ProgramData\Templates:gs5sys
AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\chef\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\chef\Cookies:gs5sys
AlternateDataStreams: C:\Users\chef\Lokale Einstellungen:gs5sys
AlternateDataStreams: C:\Users\chef\Vorlagen:gs5sys
AlternateDataStreams: C:\Users\chef\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\chef\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\chef\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\chef\AppData\Local\Anwendungsdaten:gs5sys
AlternateDataStreams: C:\Users\chef\AppData\Local\Verlauf:gs5sys
AlternateDataStreams: C:\Users\chef\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Intellinet Wireless Utility.lnk => C:\Windows\pss\Intellinet Wireless Utility.lnk.CommonStartup
MSCONFIG\startupreg: HydraVisionDesktopManager => "C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe"
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe

==================== Faulty Device Manager Devices =============

Name: Realtek RTL8168/8111-Familie-PCI-E-Gigabit-Ethernet-NIC (NDIS 6.0)
Description: Realtek RTL8168/8111-Familie-PCI-E-Gigabit-Ethernet-NIC (NDIS 6.0)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8169
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-12-13 10:48:55.404
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:48:55.212
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:48:55.029
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:48:54.834
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:48:52.667
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:48:52.426
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:48:52.169
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:48:51.898
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:47:59.836
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-13 10:47:59.585
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 39%
Total physical RAM: 3325.17 MB
Available physical RAM: 2008.26 MB
Total Pagefile: 6884.35 MB
Available Pagefile: 5305.59 MB
Total Virtual: 2047.88 MB
Available Virtual: 1890.02 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:153.38 GB) (Free:71.25 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 153 GB) (Disk ID: 3FA8567C)
Partition 1: (Active) - (Size=153 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 08.03.2014 12:45
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

elagtric 09.03.2014 09:35
hi schrauber ! erstmal grosses dankeschön für deine hilfe. hab die anweisung abgearbeitet. alle 3 tools haben nix gefunden. ausser dem aktuellen FRST-log spare ich also den platz, da ich durch das ganze wooling auf diverse logs etc. gestossen bin, die vom tag des "einfangens" stammen. wenn die frischen <sauberen> logs dennoch wichtig sein sollten, kann ich sie morgen nochmal neu anpinnen, muss leider gleich auf nachtschicht. vom prinzip her scheint mein rechner jetzt sauber zu sein, ich versteh nur nicht, wie ich mir scheinbar das zeux durch blosses anschauen eines videos einfangen konnte. ist alles noch unter quarantäne, falls das hier im board jemand näher interessiert.

hier erstmal einige logs vom 05.03.14 :

Code:
# AdwCleaner v3.020 - Bericht erstellt am 05/03/2014 um 23:20:55
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\AppData\Local\Temp\OCS\Downloads\fc14996dfa99adfc7baae624196888c5\f8b34e3b5e6e337aa6491ee3f713f8f5\adwcleaner_3.0.2.0.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Users\chef\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\chef\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\chef\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\chef\AppData\Local\NativeMessaging
Ordner Gelöscht : C:\Users\chef\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\chef\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\chef\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\chef\Documents\Mobogenie
Datei Gelöscht : C:\END

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{59CFDD71-A257-451D-9C3A-05C098F93D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\d
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3317892
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Speedchecker Limited

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]

Zeile gelöscht : user_pref("CT3317892.FF19Solved", "true");
Zeile gelöscht : user_pref("CT3317892.UserID", "UN15427285281092272");
Zeile gelöscht : user_pref("CT3317892.fullUserID", "UN15427285281092272.IN.20131230162214");
Zeile gelöscht : user_pref("CT3317892.installDate", "30/12/2013 16:22:20");
Zeile gelöscht : user_pref("CT3317892.installSessionId", "{3F2FECE7-8944-4827-B5C9-1F921DFE9CA4}");
Zeile gelöscht : user_pref("CT3317892.installSp", "false");
Zeile gelöscht : user_pref("CT3317892.installerVersion", "1.8.1.4");
Zeile gelöscht : user_pref("CT3317892.searchRevert", "false");
Zeile gelöscht : user_pref("CT3317892.searchUninstallUserMode", "2");
Zeile gelöscht : user_pref("CT3317892.searchUserMode", "2");
Zeile gelöscht : user_pref("CT3317892.toolbarInstallDate", "30-12-2013 16:22:14");
Zeile gelöscht : user_pref("CT3317892.versionFromInstaller", "10.23.0.722");
Zeile gelöscht : user_pref("CT3317892.xpeMode", "0");
Zeile gelöscht : user_pref("smartbar.machineId", "GKNWL5QRYFD9ITJH/SFACTCRQC1+DJO6AX7VLVWCJBOGHCYMYV5QXKZM8RXUCYFSW6UP2X/W5/UYKMY+OUHYDQ");

[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4172 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [4232 octets] ##########
von heute :

Code:
# AdwCleaner v3.020 - Bericht erstellt am 08/03/2014 um 20:12:00
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]


[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[R6].txt - [1233 octets] - [08/03/2014 20:12:00]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4312 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[R6].txt - [1594 octets] ##########
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.03.05.11

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
chef :: WOPR [Administrator]

05.03.2014 22:55:30
mbam-log-2014-03-05 (22-55-30).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 254173
Laufzeit: 9 Minute(n), 9 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCU\Software\AppDataLow\Software\PriceGong (PUP.Optional.PriceGong.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Conduit\FF (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Speedchecker Limited\PC Speed Up (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\ProgramData\Conduit\IE (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 5
C:\Users\chef\Downloads\bs_WireShark.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\Downloads\ca_setup.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\Downloads\ca_setup1.exe (PUP.PasswordTool) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\Downloads\wirelessnetview_setup.exe (PUP.WirelessNetworkTool) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\AppData\Local\DownloadGuide\Offers\mconduitinstaller.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
auszüge aus dem log von MS security essentials :

[CODE]Trojan:Win32/Klevate

file:C\Users\chef\AppData\Local\DownloadGuide\Offers\dprotect_setup.exe

(05.03.14 von microsoft security es
Code:
sentials in quarantäne gestellt)
das log vom JRT :

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows Vista (TM) Home Basic x86
Ran by chef on 08.03.2014 at 20:35:12,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1461220110-1976370169-1414792120-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2419B2B9-996E-419A-B79B-6600D820B370}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3081A9B6-8DEB-4423-96A2-2177723580C0}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\big fish"
Successfully deleted: [Folder] "C:\Users\chef\appdata\local\big fish"
Successfully deleted: [Folder] "C:\Users\chef\appdata\local\cre"
Successfully deleted: [Folder] "C:\bigfishcache"



~~~ FireFox

Successfully deleted the following from C:\Users\chef\AppData\Roaming\mozilla\firefox\profiles\vf5q4mw4.default\prefs.js

user_pref("extensions.toolbar@ask.com.install-event-fired", true);
Emptied folder: C:\Users\chef\AppData\Roaming\mozilla\firefox\profiles\vf5q4mw4.default\minidumps [125 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.03.2014 at 20:37:42,64
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und noch FRST :


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-03-2014
Ran by chef (administrator) on WOPR on 08-03-2014 20:42:46
Running from C:\Users\chef\Downloads
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Nitro PDF Software) C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe
(Realtek) C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Realtek Semiconductor Corp.) C:\Program Files\oem\11n USB Wireless LAN Utility\RtWlan.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [ccleaner] - C:\Program Files\CCleaner\CCleaner.exe [4324120 2013-11-22] (Piriform Ltd)
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [Spybot-S&D Cleaning] - C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {2C93367C-BA9A-4CA2-B582-4B61404C765D} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {411EA882-929B-449F-9C65-7CEDED8DEDFE} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D26464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {6BF147B5-7A30-4782-B5B9-8C0AA3632EC8} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {80E424A2-185B-4FAE-BA5E-37FBF8B2D48B} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {97132A2A-367E-4E5A-9D73-CB11EA3ECCD8} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {CC2AE24D-3E94-4B16-8A85-7B52A831737B} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default
FF SearchEngineOrder.1: Ask.com
FF Homepage: hxxp://metager.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nitropdf.com/NitroPDF - C:\Program Files\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{4737AE6A-7279-4159-9A93-1D68EF07A0AB}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{5E0C8B97-41A7-45AC-99A0-63C13108F0C4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{7DE05CB2-21C3-4827-A5AB-E6EA049CFEC5}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{9B94CAF1-8947-4C10-9426-D9779C1AD6D4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{BF7F8644-95BE-42CD-98C8-46AF33DA8E0E}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{CFA5FBE2-63F6-4659-AE63-213807DE553A}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NetVideoHunter - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\netvideohunter@netvideohunter.com [2013-12-02]
FF Extension: YouTube Unblocker - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-24]
FF Extension: DownloadHelper - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-27]
FF Extension: Ghostery - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\firefox@ghostery.com.xpi [2013-12-30]
FF Extension: TrackMeNot - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\trackmenot@mrl.nyu.edu.xpi [2012-03-30]
FF Extension: NoScript - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-03-30]
FF Extension: {a3c7fdeb-4acc-4154-b848-8b21ce7dfdee} - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{a3c7fdeb-4acc-4154-b848-8b21ce7dfdee}.xpi [2013-11-02]
FF Extension: Adblock Plus - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-19]
FF Extension: BetterPrivacy - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-04-02]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-12-19] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-03-26] (Nitro PDF Software)
R2 RealtekCU; C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\RpcAgentSrv.exe [95896 2009-03-28] (SiSoftware)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [83984 2012-02-23] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NANMp50; C:\Windows\System32\Drivers\NANMp50.sys [36408 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NANSp50; C:\Windows\System32\Drivers\NANSp50.sys [35384 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\rtwlanu.sys [864360 2011-09-06] (Realtek Semiconductor Corporation                          )
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-05-03] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S1 gfjnxobt; \??\C:\Windows\system32\drivers\gfjnxobt.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 netr28u; system32\DRIVERS\netr28u.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RTL8192su; system32\DRIVERS\RTL8192su.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:40 - 2014-03-08 19:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-08 19:29 - 2014-03-08 20:42 - 00043277 _____ () C:\Windows\WindowsUpdate.log
2014-03-07 12:59 - 2014-03-08 20:42 - 00014335 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-07 12:59 - 2014-03-07 13:00 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:58 - 2014-03-08 20:42 - 00000000 ____D () C:\FRST
2014-03-07 12:56 - 2014-03-07 12:57 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:54 - 2014-03-08 19:48 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-05 22:53 - 2014-03-08 19:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-05 22:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-05 22:50 - 2014-03-05 22:51 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-28 20:09 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-20 18:06 - 2014-02-20 18:07 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-16 21:44 - 2014-02-16 21:45 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-17 16:16 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:37 - 2014-02-16 14:40 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:35 - 2014-02-16 14:36 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-09 06:31 - 2014-02-20 17:43 - 00000000 ____D () C:\Program Files\isohero
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-07 19:32 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-07 19:32 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-07 19:32 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 18:30 - 2014-02-07 18:33 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:57 - 2014-02-07 14:58 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar
2014-02-06 23:25 - 2014-02-06 23:26 - 00000000 ____D () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001
2014-02-06 23:23 - 2014-02-06 23:24 - 06860196 _____ () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001.zip
2014-02-06 23:10 - 2014-02-07 15:02 - 00000000 ____D () C:\DOS
2014-02-06 22:56 - 2014-02-06 22:56 - 00032934 _____ () C:\Users\chef\Downloads\DOSBox-german-lang-0.74.zip
2014-02-06 22:55 - 2014-02-06 23:08 - 00005330 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox.dosbox
2014-02-06 22:53 - 2014-02-06 22:53 - 00005316 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox
2014-02-06 22:50 - 2014-02-06 22:50 - 01846392 _____ () C:\Users\chef\Downloads\Roby03.zip
2014-02-06 22:50 - 2014-02-06 22:50 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-02-06 22:41 - 2014-02-06 22:41 - 00001703 _____ () C:\Users\Public\Desktop\DOSBox 0.74.lnk
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Users\chef\AppData\Local\DOSBox
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Program Files\DOSBox
2014-02-06 22:40 - 2014-02-06 22:41 - 01448809 _____ (DOSBox Team) C:\Users\chef\Downloads\DOSBox0.74-win32-installer.exe
2014-02-06 22:34 - 2014-02-06 22:34 - 00000000 ____D () C:\Users\chef\Downloads\hquest2
2014-02-06 22:33 - 2014-02-06 22:34 - 01826500 _____ () C:\Users\chef\Downloads\hquest2.zip
2014-02-06 22:27 - 2014-02-06 22:27 - 00596689 _____ () C:\Users\chef\Downloads\Hero Quest.zip

==================== One Month Modified Files and Folders =======

2014-03-08 20:42 - 2014-03-08 19:29 - 00043277 _____ () C:\Windows\WindowsUpdate.log
2014-03-08 20:42 - 2014-03-07 12:59 - 00014335 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-08 20:42 - 2014-03-07 12:58 - 00000000 ____D () C:\FRST
2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 20:12 - 2013-09-08 22:24 - 00000000 ____D () C:\AdwCleaner
2014-03-08 19:49 - 2014-03-05 22:53 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-08 19:48 - 2014-03-05 22:54 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:41 - 2014-03-08 19:40 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-08 19:29 - 2013-05-13 21:31 - 00000620 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-03-08 19:25 - 2006-11-02 13:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-08 19:25 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-08 19:25 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-08 11:37 - 2006-11-02 13:58 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-07 13:00 - 2014-03-07 12:59 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:57 - 2014-03-07 12:56 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-06 22:38 - 2012-04-21 21:40 - 00002509 _____ () C:\Users\chef\Desktop\inSSIDer.lnk
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:51 - 2014-03-05 22:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-03-05 22:35 - 2013-12-11 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-01 19:05 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-28 20:23 - 2006-11-02 11:33 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 20:21 - 2013-10-18 12:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-21 16:37 - 2012-03-31 16:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-21 16:37 - 2012-03-31 16:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-20 18:07 - 2014-02-20 18:06 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-20 17:43 - 2014-02-09 06:31 - 00000000 ____D () C:\Program Files\isohero
2014-02-17 16:16 - 2014-02-16 14:40 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 22:37 - 2012-04-26 07:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-16 21:45 - 2014-02-16 21:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:40 - 2014-02-16 14:37 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:36 - 2014-02-16 14:35 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-07 22:35 - 2012-04-16 11:19 - 00000000 ____D () C:\Users\alle anderen\AppData\Local\VirtualStore
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-09 16:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-07 19:32 - 2013-07-04 15:10 - 00000000 ____D () C:\Program Files\Java
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 19:25 - 2013-12-22 19:49 - 00000000 ____D () C:\Users\chef\AppData\Roaming\UFOAI
2014-02-07 18:33 - 2014-02-07 18:30 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:02 - 2014-02-06 23:10 - 00000000 ____D () C:\DOS
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:58 - 2014-02-07 14:57 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar
2014-02-06 23:26 - 2014-02-06 23:25 - 00000000 ____D () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001
2014-02-06 23:24 - 2014-02-06 23:23 - 06860196 _____ () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001.zip
2014-02-06 23:08 - 2014-02-06 22:55 - 00005330 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox.dosbox
2014-02-06 22:56 - 2014-02-06 22:56 - 00032934 _____ () C:\Users\chef\Downloads\DOSBox-german-lang-0.74.zip
2014-02-06 22:53 - 2014-02-06 22:53 - 00005316 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox
2014-02-06 22:50 - 2014-02-06 22:50 - 01846392 _____ () C:\Users\chef\Downloads\Roby03.zip
2014-02-06 22:50 - 2014-02-06 22:50 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-02-06 22:41 - 2014-02-06 22:41 - 00001703 _____ () C:\Users\Public\Desktop\DOSBox 0.74.lnk
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Users\chef\AppData\Local\DOSBox
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Program Files\DOSBox
2014-02-06 22:41 - 2014-02-06 22:40 - 01448809 _____ (DOSBox Team) C:\Users\chef\Downloads\DOSBox0.74-win32-installer.exe
2014-02-06 22:34 - 2014-02-06 22:34 - 00000000 ____D () C:\Users\chef\Downloads\hquest2
2014-02-06 22:34 - 2014-02-06 22:33 - 01826500 _____ () C:\Users\chef\Downloads\hquest2.zip
2014-02-06 22:27 - 2014-02-06 22:27 - 00596689 _____ () C:\Users\chef\Downloads\Hero Quest.zip

Some content of TEMP:
====================
C:\Users\alle anderen\AppData\Local\Temp\avgnt.exe
C:\Users\chef\AppData\Local\Temp\avgnt.exe
C:\Users\Sven\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-08 19:34

==================== End Of Log ============================
--- --- ---

--- --- ---


moin schrauber, hier nochmal alle logfiles ofenfrisch :

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.03.08.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
chef :: WOPR [Administrator]

09.03.2014 08:47:11
mbam-log-2014-03-09 (08-47-11).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 254750
Laufzeit: 8 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
# AdwCleaner v3.020 - Bericht erstellt am 09/03/2014 um 08:58:21
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]


[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[R6].txt - [1674 octets] - [08/03/2014 20:12:00]
AdwCleaner[R7].txt - [1293 octets] - [09/03/2014 08:58:21]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4312 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[R7].txt - [1654 octets] ##########
Code:
# AdwCleaner v3.020 - Bericht erstellt am 09/03/2014 um 08:58:21
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]


[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[R6].txt - [1674 octets] - [08/03/2014 20:12:00]
AdwCleaner[R7].txt - [1293 octets] - [09/03/2014 08:58:21]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4312 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[R7].txt - [1654 octets] ##########

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-03-2014
Ran by chef (administrator) on WOPR on 09-03-2014 09:15:58
Running from C:\Users\chef\Downloads
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Nitro PDF Software) C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe
(Realtek) C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
(Realtek Semiconductor Corp.) C:\Program Files\oem\11n USB Wireless LAN Utility\RtWlan.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [ccleaner] - C:\Program Files\CCleaner\CCleaner.exe [4324120 2013-11-22] (Piriform Ltd)
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [Spybot-S&D Cleaning] - C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {2C93367C-BA9A-4CA2-B582-4B61404C765D} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {411EA882-929B-449F-9C65-7CEDED8DEDFE} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D26464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {6BF147B5-7A30-4782-B5B9-8C0AA3632EC8} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {80E424A2-185B-4FAE-BA5E-37FBF8B2D48B} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {97132A2A-367E-4E5A-9D73-CB11EA3ECCD8} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {CC2AE24D-3E94-4B16-8A85-7B52A831737B} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default
FF SearchEngineOrder.1: Ask.com
FF Homepage: hxxp://metager.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nitropdf.com/NitroPDF - C:\Program Files\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{4737AE6A-7279-4159-9A93-1D68EF07A0AB}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{5E0C8B97-41A7-45AC-99A0-63C13108F0C4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{7DE05CB2-21C3-4827-A5AB-E6EA049CFEC5}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{9B94CAF1-8947-4C10-9426-D9779C1AD6D4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{BF7F8644-95BE-42CD-98C8-46AF33DA8E0E}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{CFA5FBE2-63F6-4659-AE63-213807DE553A}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NetVideoHunter - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\netvideohunter@netvideohunter.com [2013-12-02]
FF Extension: YouTube Unblocker - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-24]
FF Extension: DownloadHelper - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-27]
FF Extension: Ghostery - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\firefox@ghostery.com.xpi [2013-12-30]
FF Extension: TrackMeNot - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\trackmenot@mrl.nyu.edu.xpi [2012-03-30]
FF Extension: NoScript - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-03-30]
FF Extension: {a3c7fdeb-4acc-4154-b848-8b21ce7dfdee} - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{a3c7fdeb-4acc-4154-b848-8b21ce7dfdee}.xpi [2013-11-02]
FF Extension: Adblock Plus - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-19]
FF Extension: BetterPrivacy - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-04-02]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-12-19] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-03-26] (Nitro PDF Software)
R2 RealtekCU; C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\RpcAgentSrv.exe [95896 2009-03-28] (SiSoftware)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [83984 2012-02-23] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NANMp50; C:\Windows\System32\Drivers\NANMp50.sys [36408 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NANSp50; C:\Windows\System32\Drivers\NANSp50.sys [35384 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\rtwlanu.sys [864360 2011-09-06] (Realtek Semiconductor Corporation                          )
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-05-03] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S1 gfjnxobt; \??\C:\Windows\system32\drivers\gfjnxobt.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 netr28u; system32\DRIVERS\netr28u.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RTL8192su; system32\DRIVERS\RTL8192su.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-09 09:10 - 2014-03-09 09:14 - 00022835 _____ () C:\Windows\WindowsUpdate.log
2014-03-09 09:05 - 2014-03-09 09:05 - 00000631 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-09 08:59 - 2014-03-09 08:59 - 00001734 _____ () C:\Users\chef\Documents\AdwCleaner[R7].txt
2014-03-08 20:37 - 2014-03-09 09:05 - 00000631 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:40 - 2014-03-08 19:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-07 12:59 - 2014-03-09 09:15 - 00014042 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-07 12:59 - 2014-03-07 13:00 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:58 - 2014-03-09 09:15 - 00000000 ____D () C:\FRST
2014-03-07 12:56 - 2014-03-07 12:57 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:54 - 2014-03-08 19:48 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-05 22:53 - 2014-03-08 19:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-05 22:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-05 22:50 - 2014-03-05 22:51 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-28 20:09 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-20 18:06 - 2014-02-20 18:07 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-16 21:44 - 2014-02-16 21:45 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-17 16:16 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:37 - 2014-02-16 14:40 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:35 - 2014-02-16 14:36 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-09 06:31 - 2014-02-20 17:43 - 00000000 ____D () C:\Program Files\isohero
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-07 19:32 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-07 19:32 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-07 19:32 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 18:30 - 2014-02-07 18:33 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:57 - 2014-02-07 14:58 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar

==================== One Month Modified Files and Folders =======

2014-03-09 09:16 - 2014-03-07 12:59 - 00014042 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-09 09:15 - 2014-03-09 09:10 - 00022835 _____ () C:\Windows\WindowsUpdate.log
2014-03-09 09:15 - 2014-03-07 12:58 - 00000000 ____D () C:\FRST
2014-03-09 09:10 - 2013-05-13 21:31 - 00000620 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-03-09 09:09 - 2006-11-02 13:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-09 09:09 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-09 09:09 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-09 09:08 - 2006-11-02 13:58 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-09 09:05 - 2014-03-09 09:05 - 00000631 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-09 09:05 - 2014-03-08 20:37 - 00000631 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-09 08:59 - 2014-03-09 08:59 - 00001734 _____ () C:\Users\chef\Documents\AdwCleaner[R7].txt
2014-03-09 08:58 - 2013-09-08 22:24 - 00000000 ____D () C:\AdwCleaner
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 19:49 - 2014-03-05 22:53 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-08 19:48 - 2014-03-05 22:54 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:41 - 2014-03-08 19:40 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-07 13:00 - 2014-03-07 12:59 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:57 - 2014-03-07 12:56 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-06 22:38 - 2012-04-21 21:40 - 00002509 _____ () C:\Users\chef\Desktop\inSSIDer.lnk
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:51 - 2014-03-05 22:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-03-05 22:35 - 2013-12-11 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-01 19:05 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-28 20:23 - 2006-11-02 11:33 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 20:21 - 2013-10-18 12:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-21 16:37 - 2012-03-31 16:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-21 16:37 - 2012-03-31 16:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-20 18:07 - 2014-02-20 18:06 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-20 17:43 - 2014-02-09 06:31 - 00000000 ____D () C:\Program Files\isohero
2014-02-17 16:16 - 2014-02-16 14:40 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 22:37 - 2012-04-26 07:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-16 21:45 - 2014-02-16 21:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:40 - 2014-02-16 14:37 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:36 - 2014-02-16 14:35 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-07 22:35 - 2012-04-16 11:19 - 00000000 ____D () C:\Users\alle anderen\AppData\Local\VirtualStore
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-09 16:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-07 19:32 - 2013-07-04 15:10 - 00000000 ____D () C:\Program Files\Java
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 19:25 - 2013-12-22 19:49 - 00000000 ____D () C:\Users\chef\AppData\Roaming\UFOAI
2014-02-07 18:33 - 2014-02-07 18:30 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:02 - 2014-02-06 23:10 - 00000000 ____D () C:\DOS
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:58 - 2014-02-07 14:57 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar

Some content of TEMP:
====================
C:\Users\alle anderen\AppData\Local\Temp\avgnt.exe
C:\Users\chef\AppData\Local\Temp\avgnt.exe
C:\Users\Sven\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-09 09:16

==================== End Of Log ============================
--- --- ---

--- --- ---



mit dem klevante schein ich mir ja ein relativ junges ding eingehandelt zu haben, allzuviel gibt es im web noch nicht darüber. so richtig kann ich auch noch keine verbindung zum VIS 1.01-plugin herstellen. den rest der viechter scheine ich mir bei meinen ersten gehversuchen eingehandelt zu haben, das wlan meiner nachbarn "etwas unter die lupe zu nehmen". muss den ganzen sinnlosmist mal wieder deinstallieren, hab mit 5 kindern und rollende schicht kaum wirkliche zeit, meinen rechner halbwegs sauber zu halten. inwiefern meine frau vielleicht sich infiziert hat, kann ich nicht beurteilen, aber sie hat unter vista zumindest keine administrator-rechte ... keine ahnung, ob das wirklicher schutz ist. dank dir erstmal, vielleicht sollte ich öfters mal die logfiles meiner schutztruppen durchforsten. ms-security-essentials hat am 05.03.14 ja einen ziemlichen brocken "aussortiert", ohne dass ich davon eine meldung bekam. war wirklich nur der firefox, welcher dieses VIS dingsda-plugin aus sicherheitsgrüden deaktivierte ....

spende an euch kommt, wenn meine frau mal nicht gar so sehr auf die finanzen achtet, versprochen !

elagtric 09.03.2014 09:44
Zitat:
Zitat von elagtric (Beitrag 1265085)
hi schrauber ! erstmal grosses dankeschön für deine hilfe. hab die anweisung abgearbeitet. alle 3 tools haben nix gefunden. ausser dem aktuellen FRST-log spare ich also den platz, da ich durch das ganze wooling auf diverse logs etc. gestossen bin, die vom tag des "einfangens" stammen. wenn die frischen <sauberen> logs dennoch wichtig sein sollten, kann ich sie morgen nochmal neu anpinnen, muss leider gleich auf nachtschicht. vom prinzip her scheint mein rechner jetzt sauber zu sein, ich versteh nur nicht, wie ich mir scheinbar das zeux durch blosses anschauen eines videos einfangen konnte. ist alles noch unter quarantäne, falls das hier im board jemand näher interessiert.

hier erstmal einige logs vom 05.03.14 :

Code:
# AdwCleaner v3.020 - Bericht erstellt am 05/03/2014 um 23:20:55
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\AppData\Local\Temp\OCS\Downloads\fc14996dfa99adfc7baae624196888c5\f8b34e3b5e6e337aa6491ee3f713f8f5\adwcleaner_3.0.2.0.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Users\chef\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\chef\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\chef\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\chef\AppData\Local\NativeMessaging
Ordner Gelöscht : C:\Users\chef\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\chef\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\chef\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\chef\Documents\Mobogenie
Datei Gelöscht : C:\END

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{59CFDD71-A257-451D-9C3A-05C098F93D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\d
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3317892
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Speedchecker Limited

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]

Zeile gelöscht : user_pref("CT3317892.FF19Solved", "true");
Zeile gelöscht : user_pref("CT3317892.UserID", "UN15427285281092272");
Zeile gelöscht : user_pref("CT3317892.fullUserID", "UN15427285281092272.IN.20131230162214");
Zeile gelöscht : user_pref("CT3317892.installDate", "30/12/2013 16:22:20");
Zeile gelöscht : user_pref("CT3317892.installSessionId", "{3F2FECE7-8944-4827-B5C9-1F921DFE9CA4}");
Zeile gelöscht : user_pref("CT3317892.installSp", "false");
Zeile gelöscht : user_pref("CT3317892.installerVersion", "1.8.1.4");
Zeile gelöscht : user_pref("CT3317892.searchRevert", "false");
Zeile gelöscht : user_pref("CT3317892.searchUninstallUserMode", "2");
Zeile gelöscht : user_pref("CT3317892.searchUserMode", "2");
Zeile gelöscht : user_pref("CT3317892.toolbarInstallDate", "30-12-2013 16:22:14");
Zeile gelöscht : user_pref("CT3317892.versionFromInstaller", "10.23.0.722");
Zeile gelöscht : user_pref("CT3317892.xpeMode", "0");
Zeile gelöscht : user_pref("smartbar.machineId", "GKNWL5QRYFD9ITJH/SFACTCRQC1+DJO6AX7VLVWCJBOGHCYMYV5QXKZM8RXUCYFSW6UP2X/W5/UYKMY+OUHYDQ");

[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4172 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [4232 octets] ##########
von heute :

Code:
# AdwCleaner v3.020 - Bericht erstellt am 08/03/2014 um 20:12:00
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]


[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[R6].txt - [1233 octets] - [08/03/2014 20:12:00]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4312 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[R6].txt - [1594 octets] ##########
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.03.05.11

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
chef :: WOPR [Administrator]

05.03.2014 22:55:30
mbam-log-2014-03-05 (22-55-30).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 254173
Laufzeit: 9 Minute(n), 9 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCU\Software\AppDataLow\Software\PriceGong (PUP.Optional.PriceGong.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Conduit\FF (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Speedchecker Limited\PC Speed Up (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\ProgramData\Conduit\IE (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 5
C:\Users\chef\Downloads\bs_WireShark.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\Downloads\ca_setup.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\Downloads\ca_setup1.exe (PUP.PasswordTool) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\Downloads\wirelessnetview_setup.exe (PUP.WirelessNetworkTool) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\chef\AppData\Local\DownloadGuide\Offers\mconduitinstaller.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
auszüge aus dem log von MS security essentials :

[CODE]Trojan:Win32/Klevate

file:C\Users\chef\AppData\Local\DownloadGuide\Offers\dprotect_setup.exe

(05.03.14 von microsoft security es
Code:
sentials in quarantäne gestellt)
das log vom JRT :

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows Vista (TM) Home Basic x86
Ran by chef on 08.03.2014 at 20:35:12,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1461220110-1976370169-1414792120-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2419B2B9-996E-419A-B79B-6600D820B370}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3081A9B6-8DEB-4423-96A2-2177723580C0}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\big fish"
Successfully deleted: [Folder] "C:\Users\chef\appdata\local\big fish"
Successfully deleted: [Folder] "C:\Users\chef\appdata\local\cre"
Successfully deleted: [Folder] "C:\bigfishcache"



~~~ FireFox

Successfully deleted the following from C:\Users\chef\AppData\Roaming\mozilla\firefox\profiles\vf5q4mw4.default\prefs.js

user_pref("extensions.toolbar@ask.com.install-event-fired", true);
Emptied folder: C:\Users\chef\AppData\Roaming\mozilla\firefox\profiles\vf5q4mw4.default\minidumps [125 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.03.2014 at 20:37:42,64
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und noch FRST :


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-03-2014
Ran by chef (administrator) on WOPR on 08-03-2014 20:42:46
Running from C:\Users\chef\Downloads
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Nitro PDF Software) C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe
(Realtek) C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Realtek Semiconductor Corp.) C:\Program Files\oem\11n USB Wireless LAN Utility\RtWlan.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [ccleaner] - C:\Program Files\CCleaner\CCleaner.exe [4324120 2013-11-22] (Piriform Ltd)
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [Spybot-S&D Cleaning] - C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {2C93367C-BA9A-4CA2-B582-4B61404C765D} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {411EA882-929B-449F-9C65-7CEDED8DEDFE} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D26464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {6BF147B5-7A30-4782-B5B9-8C0AA3632EC8} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {80E424A2-185B-4FAE-BA5E-37FBF8B2D48B} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {97132A2A-367E-4E5A-9D73-CB11EA3ECCD8} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {CC2AE24D-3E94-4B16-8A85-7B52A831737B} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default
FF SearchEngineOrder.1: Ask.com
FF Homepage: hxxp://metager.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nitropdf.com/NitroPDF - C:\Program Files\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{4737AE6A-7279-4159-9A93-1D68EF07A0AB}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{5E0C8B97-41A7-45AC-99A0-63C13108F0C4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{7DE05CB2-21C3-4827-A5AB-E6EA049CFEC5}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{9B94CAF1-8947-4C10-9426-D9779C1AD6D4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{BF7F8644-95BE-42CD-98C8-46AF33DA8E0E}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{CFA5FBE2-63F6-4659-AE63-213807DE553A}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NetVideoHunter - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\netvideohunter@netvideohunter.com [2013-12-02]
FF Extension: YouTube Unblocker - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-24]
FF Extension: DownloadHelper - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-27]
FF Extension: Ghostery - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\firefox@ghostery.com.xpi [2013-12-30]
FF Extension: TrackMeNot - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\trackmenot@mrl.nyu.edu.xpi [2012-03-30]
FF Extension: NoScript - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-03-30]
FF Extension: {a3c7fdeb-4acc-4154-b848-8b21ce7dfdee} - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{a3c7fdeb-4acc-4154-b848-8b21ce7dfdee}.xpi [2013-11-02]
FF Extension: Adblock Plus - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-19]
FF Extension: BetterPrivacy - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-04-02]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-12-19] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-03-26] (Nitro PDF Software)
R2 RealtekCU; C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\RpcAgentSrv.exe [95896 2009-03-28] (SiSoftware)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [83984 2012-02-23] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NANMp50; C:\Windows\System32\Drivers\NANMp50.sys [36408 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NANSp50; C:\Windows\System32\Drivers\NANSp50.sys [35384 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\rtwlanu.sys [864360 2011-09-06] (Realtek Semiconductor Corporation                          )
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-05-03] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S1 gfjnxobt; \??\C:\Windows\system32\drivers\gfjnxobt.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 netr28u; system32\DRIVERS\netr28u.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RTL8192su; system32\DRIVERS\RTL8192su.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:40 - 2014-03-08 19:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-08 19:29 - 2014-03-08 20:42 - 00043277 _____ () C:\Windows\WindowsUpdate.log
2014-03-07 12:59 - 2014-03-08 20:42 - 00014335 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-07 12:59 - 2014-03-07 13:00 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:58 - 2014-03-08 20:42 - 00000000 ____D () C:\FRST
2014-03-07 12:56 - 2014-03-07 12:57 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:54 - 2014-03-08 19:48 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-05 22:53 - 2014-03-08 19:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-05 22:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-05 22:50 - 2014-03-05 22:51 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-28 20:09 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-20 18:06 - 2014-02-20 18:07 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-16 21:44 - 2014-02-16 21:45 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-17 16:16 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:37 - 2014-02-16 14:40 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:35 - 2014-02-16 14:36 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-09 06:31 - 2014-02-20 17:43 - 00000000 ____D () C:\Program Files\isohero
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-07 19:32 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-07 19:32 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-07 19:32 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 18:30 - 2014-02-07 18:33 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:57 - 2014-02-07 14:58 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar
2014-02-06 23:25 - 2014-02-06 23:26 - 00000000 ____D () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001
2014-02-06 23:23 - 2014-02-06 23:24 - 06860196 _____ () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001.zip
2014-02-06 23:10 - 2014-02-07 15:02 - 00000000 ____D () C:\DOS
2014-02-06 22:56 - 2014-02-06 22:56 - 00032934 _____ () C:\Users\chef\Downloads\DOSBox-german-lang-0.74.zip
2014-02-06 22:55 - 2014-02-06 23:08 - 00005330 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox.dosbox
2014-02-06 22:53 - 2014-02-06 22:53 - 00005316 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox
2014-02-06 22:50 - 2014-02-06 22:50 - 01846392 _____ () C:\Users\chef\Downloads\Roby03.zip
2014-02-06 22:50 - 2014-02-06 22:50 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-02-06 22:41 - 2014-02-06 22:41 - 00001703 _____ () C:\Users\Public\Desktop\DOSBox 0.74.lnk
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Users\chef\AppData\Local\DOSBox
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Program Files\DOSBox
2014-02-06 22:40 - 2014-02-06 22:41 - 01448809 _____ (DOSBox Team) C:\Users\chef\Downloads\DOSBox0.74-win32-installer.exe
2014-02-06 22:34 - 2014-02-06 22:34 - 00000000 ____D () C:\Users\chef\Downloads\hquest2
2014-02-06 22:33 - 2014-02-06 22:34 - 01826500 _____ () C:\Users\chef\Downloads\hquest2.zip
2014-02-06 22:27 - 2014-02-06 22:27 - 00596689 _____ () C:\Users\chef\Downloads\Hero Quest.zip

==================== One Month Modified Files and Folders =======

2014-03-08 20:42 - 2014-03-08 19:29 - 00043277 _____ () C:\Windows\WindowsUpdate.log
2014-03-08 20:42 - 2014-03-07 12:59 - 00014335 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-08 20:42 - 2014-03-07 12:58 - 00000000 ____D () C:\FRST
2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-08 20:37 - 2014-03-08 20:37 - 00001682 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 20:12 - 2013-09-08 22:24 - 00000000 ____D () C:\AdwCleaner
2014-03-08 19:49 - 2014-03-05 22:53 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-08 19:48 - 2014-03-05 22:54 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:41 - 2014-03-08 19:40 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-08 19:29 - 2013-05-13 21:31 - 00000620 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-03-08 19:25 - 2006-11-02 13:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-08 19:25 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-08 19:25 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-08 11:37 - 2006-11-02 13:58 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-07 13:00 - 2014-03-07 12:59 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:57 - 2014-03-07 12:56 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-06 22:38 - 2012-04-21 21:40 - 00002509 _____ () C:\Users\chef\Desktop\inSSIDer.lnk
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:51 - 2014-03-05 22:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-03-05 22:35 - 2013-12-11 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-01 19:05 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-28 20:23 - 2006-11-02 11:33 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 20:21 - 2013-10-18 12:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-21 16:37 - 2012-03-31 16:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-21 16:37 - 2012-03-31 16:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-20 18:07 - 2014-02-20 18:06 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-20 17:43 - 2014-02-09 06:31 - 00000000 ____D () C:\Program Files\isohero
2014-02-17 16:16 - 2014-02-16 14:40 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 22:37 - 2012-04-26 07:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-16 21:45 - 2014-02-16 21:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:40 - 2014-02-16 14:37 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:36 - 2014-02-16 14:35 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-07 22:35 - 2012-04-16 11:19 - 00000000 ____D () C:\Users\alle anderen\AppData\Local\VirtualStore
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-09 16:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-07 19:32 - 2013-07-04 15:10 - 00000000 ____D () C:\Program Files\Java
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 19:25 - 2013-12-22 19:49 - 00000000 ____D () C:\Users\chef\AppData\Roaming\UFOAI
2014-02-07 18:33 - 2014-02-07 18:30 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:02 - 2014-02-06 23:10 - 00000000 ____D () C:\DOS
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:58 - 2014-02-07 14:57 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar
2014-02-06 23:26 - 2014-02-06 23:25 - 00000000 ____D () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001
2014-02-06 23:24 - 2014-02-06 23:23 - 06860196 _____ () C:\Users\chef\Downloads\dosbox-game-launcher-dbgl_23001.zip
2014-02-06 23:08 - 2014-02-06 22:55 - 00005330 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox.dosbox
2014-02-06 22:56 - 2014-02-06 22:56 - 00032934 _____ () C:\Users\chef\Downloads\DOSBox-german-lang-0.74.zip
2014-02-06 22:53 - 2014-02-06 22:53 - 00005316 _____ () C:\Users\chef\Documents\HEROGERMAN.dosbox
2014-02-06 22:50 - 2014-02-06 22:50 - 01846392 _____ () C:\Users\chef\Downloads\Roby03.zip
2014-02-06 22:50 - 2014-02-06 22:50 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-02-06 22:41 - 2014-02-06 22:41 - 00001703 _____ () C:\Users\Public\Desktop\DOSBox 0.74.lnk
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Users\chef\AppData\Local\DOSBox
2014-02-06 22:41 - 2014-02-06 22:41 - 00000000 ____D () C:\Program Files\DOSBox
2014-02-06 22:41 - 2014-02-06 22:40 - 01448809 _____ (DOSBox Team) C:\Users\chef\Downloads\DOSBox0.74-win32-installer.exe
2014-02-06 22:34 - 2014-02-06 22:34 - 00000000 ____D () C:\Users\chef\Downloads\hquest2
2014-02-06 22:34 - 2014-02-06 22:33 - 01826500 _____ () C:\Users\chef\Downloads\hquest2.zip
2014-02-06 22:27 - 2014-02-06 22:27 - 00596689 _____ () C:\Users\chef\Downloads\Hero Quest.zip

Some content of TEMP:
====================
C:\Users\alle anderen\AppData\Local\Temp\avgnt.exe
C:\Users\chef\AppData\Local\Temp\avgnt.exe
C:\Users\Sven\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-08 19:34

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


moin schrauber, hier nochmal alle logfiles ofenfrisch :

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.03.08.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
chef :: WOPR [Administrator]

09.03.2014 08:47:11
mbam-log-2014-03-09 (08-47-11).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 254750
Laufzeit: 8 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
# AdwCleaner v3.020 - Bericht erstellt am 09/03/2014 um 08:58:21
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]


[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[R6].txt - [1674 octets] - [08/03/2014 20:12:00]
AdwCleaner[R7].txt - [1293 octets] - [09/03/2014 08:58:21]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4312 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[R7].txt - [1654 octets] ##########
Code:
# AdwCleaner v3.020 - Bericht erstellt am 09/03/2014 um 08:58:21
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : chef - WOPR
# Gestartet von : C:\Users\chef\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16526


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\prefs.js ]


[ Datei : C:\Users\alle anderen\AppData\Roaming\Mozilla\Firefox\Profiles\9c6m2ycm.default\prefs.js ]


[ Datei : C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ugxwy39g.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [10959 octets] - [08/09/2013 22:25:35]
AdwCleaner[R1].txt - [1252 octets] - [08/09/2013 22:33:39]
AdwCleaner[R2].txt - [2732 octets] - [10/11/2013 18:23:21]
AdwCleaner[R3].txt - [2761 octets] - [13/11/2013 20:14:30]
AdwCleaner[R4].txt - [1444 octets] - [28/11/2013 07:45:35]
AdwCleaner[R5].txt - [4227 octets] - [05/03/2014 23:18:33]
AdwCleaner[R6].txt - [1674 octets] - [08/03/2014 20:12:00]
AdwCleaner[R7].txt - [1293 octets] - [09/03/2014 08:58:21]
AdwCleaner[S0].txt - [10791 octets] - [08/09/2013 22:26:14]
AdwCleaner[S1].txt - [2665 octets] - [10/11/2013 18:24:33]
AdwCleaner[S2].txt - [2683 octets] - [13/11/2013 20:15:06]
AdwCleaner[S3].txt - [1505 octets] - [28/11/2013 07:46:54]
AdwCleaner[S4].txt - [4312 octets] - [05/03/2014 23:20:55]

########## EOF - C:\AdwCleaner\AdwCleaner[R7].txt - [1654 octets] ##########

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-03-2014
Ran by chef (administrator) on WOPR on 09-03-2014 09:15:58
Running from C:\Users\chef\Downloads
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Nitro PDF Software) C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe
(Realtek) C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
(Realtek Semiconductor Corp.) C:\Program Files\oem\11n USB Wireless LAN Utility\RtWlan.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [ccleaner] - C:\Program Files\CCleaner\CCleaner.exe [4324120 2013-11-22] (Piriform Ltd)
HKU\S-1-5-21-1461220110-1976370169-1414792120-1000\...\Run: [Spybot-S&D Cleaning] - C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)

==================== Internet (Whitelisted) ====================

URLSearchHook: HKCU - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {2C93367C-BA9A-4CA2-B582-4B61404C765D} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {411EA882-929B-449F-9C65-7CEDED8DEDFE} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D26464F524D3D494538535243&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&k=0
SearchScopes: HKCU - {6BF147B5-7A30-4782-B5B9-8C0AA3632EC8} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {80E424A2-185B-4FAE-BA5E-37FBF8B2D48B} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {97132A2A-367E-4E5A-9D73-CB11EA3ECCD8} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
SearchScopes: HKCU - {CC2AE24D-3E94-4B16-8A85-7B52A831737B} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=0f8a6cfe-902a-4c11-8265-9538cb8a19a4&pid=proxtubede&mode=bounce&k=0
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default
FF SearchEngineOrder.1: Ask.com
FF Homepage: hxxp://metager.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nitropdf.com/NitroPDF - C:\Program Files\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{4737AE6A-7279-4159-9A93-1D68EF07A0AB}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{5E0C8B97-41A7-45AC-99A0-63C13108F0C4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{7DE05CB2-21C3-4827-A5AB-E6EA049CFEC5}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{9B94CAF1-8947-4C10-9426-D9779C1AD6D4}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{BF7F8644-95BE-42CD-98C8-46AF33DA8E0E}.xml
FF SearchPlugin: C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\searchplugins\{CFA5FBE2-63F6-4659-AE63-213807DE553A}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: NetVideoHunter - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\netvideohunter@netvideohunter.com [2013-12-02]
FF Extension: YouTube Unblocker - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-24]
FF Extension: DownloadHelper - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-27]
FF Extension: Ghostery - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\firefox@ghostery.com.xpi [2013-12-30]
FF Extension: TrackMeNot - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\trackmenot@mrl.nyu.edu.xpi [2012-03-30]
FF Extension: NoScript - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-03-30]
FF Extension: {a3c7fdeb-4acc-4154-b848-8b21ce7dfdee} - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{a3c7fdeb-4acc-4154-b848-8b21ce7dfdee}.xpi [2013-11-02]
FF Extension: Adblock Plus - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-19]
FF Extension: BetterPrivacy - C:\Users\chef\AppData\Roaming\Mozilla\Firefox\Profiles\vf5q4mw4.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-04-02]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2012-12-19] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-03-26] (Nitro PDF Software)
R2 RealtekCU; C:\Program Files\oem\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\RpcAgentSrv.exe [95896 2009-03-28] (SiSoftware)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [83984 2012-02-23] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NANMp50; C:\Windows\System32\Drivers\NANMp50.sys [36408 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NANSp50; C:\Windows\System32\Drivers\NANSp50.sys [35384 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\rtwlanu.sys [864360 2011-09-06] (Realtek Semiconductor Corporation                          )
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP3\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-05-03] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S1 gfjnxobt; \??\C:\Windows\system32\drivers\gfjnxobt.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 netr28u; system32\DRIVERS\netr28u.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RTL8192su; system32\DRIVERS\RTL8192su.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-09 09:10 - 2014-03-09 09:14 - 00022835 _____ () C:\Windows\WindowsUpdate.log
2014-03-09 09:05 - 2014-03-09 09:05 - 00000631 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-09 08:59 - 2014-03-09 08:59 - 00001734 _____ () C:\Users\chef\Documents\AdwCleaner[R7].txt
2014-03-08 20:37 - 2014-03-09 09:05 - 00000631 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:40 - 2014-03-08 19:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-07 12:59 - 2014-03-09 09:15 - 00014042 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-07 12:59 - 2014-03-07 13:00 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:58 - 2014-03-09 09:15 - 00000000 ____D () C:\FRST
2014-03-07 12:56 - 2014-03-07 12:57 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:54 - 2014-03-08 19:48 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-05 22:53 - 2014-03-08 19:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-05 22:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-05 22:50 - 2014-03-05 22:51 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-28 20:09 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-20 18:06 - 2014-02-20 18:07 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-16 21:44 - 2014-02-16 21:45 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-17 16:16 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:37 - 2014-02-16 14:40 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:35 - 2014-02-16 14:36 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-09 06:31 - 2014-02-20 17:43 - 00000000 ____D () C:\Program Files\isohero
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-07 19:32 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-07 19:32 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-07 19:32 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 18:30 - 2014-02-07 18:33 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:57 - 2014-02-07 14:58 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar

==================== One Month Modified Files and Folders =======

2014-03-09 09:16 - 2014-03-07 12:59 - 00014042 _____ () C:\Users\chef\Downloads\FRST.txt
2014-03-09 09:15 - 2014-03-09 09:10 - 00022835 _____ () C:\Windows\WindowsUpdate.log
2014-03-09 09:15 - 2014-03-07 12:58 - 00000000 ____D () C:\FRST
2014-03-09 09:10 - 2013-05-13 21:31 - 00000620 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2014-03-09 09:09 - 2006-11-02 13:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-09 09:09 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-09 09:09 - 2006-11-02 13:45 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-09 09:08 - 2006-11-02 13:58 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-09 09:05 - 2014-03-09 09:05 - 00000631 _____ () C:\Users\chef\Desktop\JRT.txt
2014-03-09 09:05 - 2014-03-08 20:37 - 00000631 _____ () C:\Users\chef\Documents\JRT.txt
2014-03-09 08:59 - 2014-03-09 08:59 - 00001734 _____ () C:\Users\chef\Documents\AdwCleaner[R7].txt
2014-03-09 08:58 - 2013-09-08 22:24 - 00000000 ____D () C:\AdwCleaner
2014-03-08 20:35 - 2014-03-08 20:35 - 00000000 ____D () C:\Windows\ERUNT
2014-03-08 20:29 - 2014-03-08 20:29 - 00000159 _____ () C:\Users\chef\Documents\ms-sec.txt
2014-03-08 20:19 - 2014-03-08 20:19 - 00004312 _____ () C:\Users\chef\Documents\AdwCleaner[S4].txt
2014-03-08 20:16 - 2014-03-08 20:16 - 00001674 _____ () C:\Users\chef\Documents\AdwCleaner[R6].txt
2014-03-08 19:49 - 2014-03-05 22:53 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-03-08 19:48 - 2014-03-05 22:54 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 19:43 - 2014-03-08 19:43 - 01037734 _____ (Thisisu) C:\Users\chef\Downloads\JRT.exe
2014-03-08 19:42 - 2014-03-08 19:42 - 01244192 _____ () C:\Users\chef\Downloads\adwcleaner.exe
2014-03-08 19:41 - 2014-03-08 19:40 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-03-07 13:00 - 2014-03-07 12:59 - 00023028 _____ () C:\Users\chef\Downloads\Addition.txt
2014-03-07 12:57 - 2014-03-07 12:56 - 01145344 _____ (Farbar) C:\Users\chef\Downloads\FRST.exe
2014-03-06 22:38 - 2012-04-21 21:40 - 00002509 _____ () C:\Users\chef\Desktop\inSSIDer.lnk
2014-03-05 23:16 - 2014-03-05 23:16 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-05 22:51 - 2014-03-05 22:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\chef\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 22:48 - 2014-03-05 22:48 - 00613200 _____ (Chip Digital GmbH) C:\Users\chef\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-03-05 22:35 - 2013-12-11 17:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-01 19:05 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-28 20:23 - 2006-11-02 11:33 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 20:21 - 2013-10-18 12:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-21 16:37 - 2012-03-31 16:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-21 16:37 - 2012-03-31 16:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-20 18:07 - 2014-02-20 18:06 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win(1).zip
2014-02-20 17:43 - 2014-02-09 06:31 - 00000000 ____D () C:\Program Files\isohero
2014-02-17 16:16 - 2014-02-16 14:40 - 00000000 ____D () C:\Users\chef\AppData\Roaming\RavensburgerTipToi
2014-02-16 22:37 - 2012-04-26 07:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-16 21:45 - 2014-02-16 21:44 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-16 14:40 - 2014-02-16 14:40 - 00000869 _____ () C:\Users\chef\Desktop\tiptoi - Verknüpfung.lnk
2014-02-16 14:40 - 2014-02-16 14:37 - 00000000 ____D () C:\ProgramData\RavensburgerTipToi
2014-02-16 14:37 - 2014-02-16 14:37 - 00000000 ____D () C:\Program Files\Ravensburger tiptoi
2014-02-16 14:36 - 2014-02-16 14:35 - 13251567 _____ () C:\Users\chef\Downloads\install.exe
2014-02-09 06:36 - 2014-02-09 06:36 - 00000000 _____ () C:\Users\chef\Downloads\savegame.txt
2014-02-07 22:35 - 2012-04-16 11:19 - 00000000 ____D () C:\Users\alle anderen\AppData\Local\VirtualStore
2014-02-07 19:33 - 2014-02-07 19:33 - 00000000 ____D () C:\Windows\Sun
2014-02-07 19:32 - 2013-12-09 16:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-07 19:32 - 2013-07-04 15:10 - 00000000 ____D () C:\Program Files\Java
2014-02-07 19:30 - 2014-02-07 19:30 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(5).exe
2014-02-07 19:28 - 2014-02-07 19:28 - 00921000 _____ (Oracle Corporation) C:\Users\chef\Downloads\jxpiinstall(4).exe
2014-02-07 19:25 - 2013-12-22 19:49 - 00000000 ____D () C:\Users\chef\AppData\Roaming\UFOAI
2014-02-07 18:33 - 2014-02-07 18:30 - 15446935 _____ () C:\Users\chef\Downloads\isometric-heroquest-en-win.zip
2014-02-07 15:02 - 2014-02-06 23:10 - 00000000 ____D () C:\DOS
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Users\chef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-02-07 15:01 - 2014-02-07 15:01 - 00000000 ____D () C:\Program Files\WinRAR
2014-02-07 15:00 - 2014-02-07 15:00 - 01867568 _____ () C:\Users\chef\Downloads\wrar501d.exe
2014-02-07 14:58 - 2014-02-07 14:57 - 02325339 _____ () C:\Users\chef\Downloads\heroquest.rar

Some content of TEMP:
====================
C:\Users\alle anderen\AppData\Local\Temp\avgnt.exe
C:\Users\chef\AppData\Local\Temp\avgnt.exe
C:\Users\Sven\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-09 09:16

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---



mit dem klevante schein ich mir ja ein relativ junges ding eingehandelt zu haben, allzuviel gibt es im web noch nicht darüber. so richtig kann ich auch noch keine verbindung zum VIS 1.01-plugin herstellen. den rest der viechter scheine ich mir bei meinen ersten gehversuchen eingehandelt zu haben, das wlan meiner nachbarn "etwas unter die lupe zu nehmen". muss den ganzen sinnlosmist mal wieder deinstallieren, hab mit 5 kindern und rollende schicht kaum wirkliche zeit, meinen rechner halbwegs sauber zu halten. inwiefern meine frau vielleicht sich infiziert hat, kann ich nicht beurteilen, aber sie hat unter vista zumindest keine administrator-rechte ... keine ahnung, ob das wirklicher schutz ist. dank dir erstmal, vielleicht sollte ich öfters mal die logfiles meiner schutztruppen durchforsten. ms-security-essentials hat am 05.03.14 ja einen ziemlichen brocken "aussortiert", ohne dass ich davon eine meldung bekam. war wirklich nur der firefox, welcher dieses VIS dingsda-plugin aus sicherheitsgrüden deaktivierte ....

spende an euch kommt, wenn meine frau mal nicht gar so sehr auf die finanzen achtet, versprochen !
hab wohl den adwcleaner doppelt und den JRT unterschlagen :

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows Vista (TM) Home Basic x86
Ran by chef on 09.03.2014 at  9:03:05,13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.03.2014 at  9:05:34,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

schrauber 10.03.2014 10:32

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

elagtric 10.03.2014 18:02
moin schrauber. nein, keine weiteren probleme. denke, das hat sich nach den quarantäneaktionen vom ms-security-essentials und kurz drauf den MBAM erledigt. bleiben halt ein paar offene fragen :

- kann man sich wirklich so einfach solchen mist durch blosses anschauen eines videos auf youtube einhandeln ?
- falls der "klevante" der erste war, wozu das doch recht offensichtliche Addon "VIS 1.01" ? von mir DEFINITIV nicht installiert !
- falls VIS der/das erste war : weshalb steckt MS security irgendwelche dinger in quarantäne, ohne mich zu informieren ? wer wertet schon täglich allerlei logfiles aus ? und wo/wie kam es überhaupt unter meine heimischen addons ?

werde mich die tage erstmal um das zeug kümmern, dass MBAM sauer aufgestossen ist und vor allen dingen erstmal den download-ordner bereinigen. ist ja wahnsinn, an was für altem zeug sich der ESET abarbeitete.

hier also die erbetenen logfiles :

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2c9a9d24315be6448db550fac8567cc0
# engine=17382
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-03-10 04:29:22
# local_time=2014-03-10 05:29:22 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 10392 140239446 3145 0
# compatibility_mode=5892 16776574 100 100 164836 232001734 0 0
# scanned=116134
# found=0
# cleaned=0
# scan_time=5511

und :

Results of screen317's Security Check version 0.99.80
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware Version 1.75.0.1300
CCleaner
Java 7 Update 51
Adobe Flash Player 12.0.0.70
Mozilla Firefox (27.0.1)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Spybot Teatimer.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````


heute mal ohne code/code, da mein noscript immernoch meckert, und ich nur wegen google analytics nicht alles auf "temporär alles erlauben" setzen wollte. wäre meine vorherige tipperei durch neuladen verloren gegangen ...

fehlt noch FRST :

Results of screen317's Security Check version 0.99.80
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware Version 1.75.0.1300
CCleaner
Java 7 Update 51
Adobe Flash Player 12.0.0.70
Mozilla Firefox (27.0.1)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Spybot Teatimer.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````


mfg, elagtric



nachtrag: ich bekomme den windows-defender nimmer gestartet. kommt eine box mit (geht leider nicht über zwischenablage ... ) :

"windows defender hat einen fehler festgestellt : 0x800705b4. Dieser vorgang wurde wegen zeitüberschreitung zurückgegeben."

any hints ?

schrauber 11.03.2014 13:05
schauen wir mal:

Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.





Zitat:
kann man sich wirklich so einfach solchen mist durch blosses anschauen eines videos auf youtube einhandeln ?
Nur mal so als Beispiel:
Caphaw Trojan Found in Youtube Ads | Emsisoft Blog

elagtric 12.03.2014 12:48
moin schrauber

obwohl trojaner-board erlaubt ist, funktioniert das mit der raute ( code einfügen ) nur, wenn ich via NOSCRIPT temporär alles erlaube. alles nur google-kram (analytics, adsense usw ... )
aber das ist wohl eher kosmetisch ...

hier das log von FSS :

Code:
Farbar Service Scanner Version: 25-02-2014
Ran by chef (administrator) on 11-03-2014 at 17:32:02
Running from "C:\Users\chef\Downloads"
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-10-18 11:46] - [2013-07-05 04:20] - 0914880 ____A (Microsoft Corporation) 6D0D344F643E28B31262AC2682109A3C

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****
hatte heute bei einem suchlauf von MBAM nochmal 13 infizierte datein, war aber alles quarantänezeugs von ADWCLEANER. hab die quarantänestation halt erstmal geräumt.

moin schrauber :

hab mal nach der defender-fehlermeldung gegoogelt und erfahren, dass der nicht zusammen mit ms-security essentials läuft. könnte es quasi schon gewesen sein ...

schrauber 13.03.2014 09:00
Zitat:
aber das ist wohl eher kosmetisch ...
jup. Irgend ein Script.

Jup, einige AV Programme deaktivieren den Defender. Log sieht gut aus.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:17 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27