Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Optimizer Pro (https://www.trojaner-board.de/151370-optimizer-pro.html)

schrauber 01.04.2014 12:03
Die Windows taste ist die mit dem Windows Logo, links neben der Leertaste, neben ALT, die zeitgleich mit der R Taste drücken.

Ich empfehle immer Emsisoft :).

hobgoblin 05.04.2014 08:44
So, was lange währt...


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Alannah (administrator) on ALANNAH2 on 05-04-2014 09:34:43
Running from C:\Users\Alannah\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PPSL51UF
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\ATouch64.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
() C:\Program Files (x86)\PHotkey\POSD.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-01-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [11406608 2011-12-20] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2884880 2012-02-23] (Synaptics Incorporated)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:
=======
CHR HomePage: hxxp://www.buenosearch.com/?babsrc=HP_ss&mntrId=8CC9685D4304A6C9&affID=127690&tsp=5186
CHR DefaultSearchKeyword: search.snapdo.com
CHR DefaultSearchProvider: Web
CHR DefaultSearchURL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZDr--M9JXGUna0zeoImavS8dwlnZzuharLSINkgsa_ialwfeDT9LSCgUW03RjyyDSs7wuz4P6mPsS86dF0d8GFH2feKmg8bvZSBUcNnyHI2DN64Gc3rBvZwOIUumIwJp9zDD9ZEiqbcPQ,,&q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Alannah\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\plugin/npUrlAdvisor.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Alannah\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Alannah\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U2) - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Extension: (Google Wallet) - C:\Users\Alannah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-19]

==================== Services (Whitelisted) =================

R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-14] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-03-28] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-05 09:28 - 2014-04-05 09:28 - 00000065 _____ () C:\Users\Alannah\Desktop\Fixlist.txt
2014-03-28 16:08 - 2014-03-28 16:09 - 00014937 _____ () C:\Users\Alannah\Downloads\Addition.txt
2014-03-28 16:07 - 2014-03-28 16:09 - 00038122 _____ () C:\Users\Alannah\Downloads\FRST.txt
2014-03-28 16:06 - 2014-03-28 16:07 - 02157056 _____ (Farbar) C:\Users\Alannah\Downloads\FRST64.exe
2014-03-28 15:42 - 2014-03-28 15:43 - 01038974 _____ (Thisisu) C:\Users\Alannah\Downloads\JRT.exe
2014-03-28 15:26 - 2014-03-28 15:26 - 01950720 _____ () C:\Users\Alannah\Downloads\adwcleaner.exe
2014-03-28 14:40 - 2014-03-28 17:21 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-28 14:37 - 2014-03-28 14:38 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Alannah\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 16:07 - 2014-03-27 16:11 - 65446536 _____ (Microsoft Corporation) C:\Users\Alannah\Downloads\EIE11_DE-AT_MCM_WIN764.EXE
2014-03-27 14:45 - 2014-03-27 14:45 - 00020545 _____ () C:\ComboFix.txt
2014-03-27 14:24 - 2014-03-27 14:24 - 00000000 ___RD () C:\Users\Alannah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-03-27 14:09 - 2014-03-27 14:21 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-03-23 09:05 - 2014-04-05 08:47 - 00000000 ____D () C:\Users\Alannah\Documents\Youcam
2014-03-23 09:03 - 2014-04-05 08:45 - 00002072 _____ () C:\Windows\setupact.log
2014-03-23 09:03 - 2014-03-30 09:16 - 00004114 _____ () C:\Windows\PFRO.log
2014-03-23 09:03 - 2014-03-23 09:03 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-22 19:54 - 2014-03-22 19:54 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Alannah\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-22 19:00 - 2014-03-22 19:00 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\ASCOMP Software
2014-03-22 18:59 - 2014-03-22 18:59 - 03640712 _____ (ASCOMP Software GmbH ) C:\Users\Alannah\Downloads\csuite21.exe
2014-03-22 17:49 - 2014-03-22 18:55 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-03-22 17:46 - 2014-03-22 18:55 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-03-22 13:57 - 2014-03-22 13:57 - 00000000 ___RD () C:\Users\Alannah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-22 13:51 - 2014-03-22 13:51 - 00000000 ____D () C:\Users\Alannah\AppData\Local\Tuguu_SL
2014-03-22 13:40 - 2014-03-22 13:56 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-14 15:33 - 2014-03-14 15:33 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-03-14 15:31 - 2014-03-14 15:32 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-03-14 15:29 - 2014-03-14 15:29 - 00000000 ____D () C:\Users\Alannah\redist
2014-03-14 15:29 - 2014-03-14 15:29 - 00000000 ____D () C:\Users\Alannah\readmes
2014-03-14 15:29 - 2014-03-14 15:29 - 00000000 ____D () C:\Users\Alannah\licenses
2014-03-14 15:28 - 2014-03-14 15:28 - 163606685 _____ () C:\Users\Alannah\Downloads\install-openoffice4.exe
2014-03-14 15:09 - 2014-03-14 15:09 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\OpenOffice
2014-03-14 15:03 - 2014-03-27 14:16 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\1H1Q
2014-03-14 13:52 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 13:52 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 13:52 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 13:52 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 13:52 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 13:52 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 13:52 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 13:52 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 13:52 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 13:52 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 13:52 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 13:52 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 13:52 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 13:52 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 13:52 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 13:52 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 13:52 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 13:52 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 13:52 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 13:52 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 13:52 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 13:52 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 13:52 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 13:52 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 13:52 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 13:52 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 13:52 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 13:52 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 13:52 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 13:52 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 13:52 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 13:52 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 13:52 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 13:52 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 13:52 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 13:52 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 13:52 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 13:52 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 13:52 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 13:52 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 13:50 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-14 13:50 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-14 13:50 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 13:50 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-14 13:50 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-14 13:50 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-14 13:50 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-14 13:49 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

==================== One Month Modified Files and Folders =======

2014-04-05 09:34 - 2013-08-29 08:33 - 00000000 ____D () C:\FRST
2014-04-05 09:28 - 2014-04-05 09:28 - 00000065 _____ () C:\Users\Alannah\Desktop\Fixlist.txt
2014-04-05 08:54 - 2012-05-06 19:34 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-05 08:52 - 2009-07-14 06:45 - 00017264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-05 08:52 - 2009-07-14 06:45 - 00017264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-05 08:50 - 2012-05-06 19:32 - 01572556 _____ () C:\Windows\WindowsUpdate.log
2014-04-05 08:49 - 2012-06-24 14:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-05 08:47 - 2014-03-23 09:05 - 00000000 ____D () C:\Users\Alannah\Documents\Youcam
2014-04-05 08:45 - 2014-03-23 09:03 - 00002072 _____ () C:\Windows\setupact.log
2014-04-05 08:45 - 2012-05-06 19:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-05 08:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-04 18:27 - 2012-08-05 17:54 - 00002155 _____ () C:\Windows\epplauncher.mif
2014-04-04 18:26 - 2012-08-05 17:54 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-04-04 18:26 - 2012-08-05 17:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-04-03 19:40 - 2013-01-07 14:51 - 00000000 ____D () C:\Users\Alannah\Desktop\Drucken
2014-04-03 19:38 - 2014-01-25 15:16 - 00000000 ____D () C:\Users\Alannah\Desktop\Praxis Manicke
2014-04-02 14:22 - 2013-03-15 09:51 - 00000000 ____D () C:\Users\Alannah\Desktop\Ferienwohnung
2014-04-01 20:11 - 2012-02-21 20:50 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-01 20:11 - 2012-02-21 20:50 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-01 20:11 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-31 19:50 - 2014-01-29 12:23 - 00000000 ____D () C:\Users\Alannah\Desktop\Jobsuche
2014-03-30 19:45 - 2013-11-05 20:30 - 00000000 ____D () C:\Users\Alannah\Desktop\Homöopathie von Iris
2014-03-30 09:16 - 2014-03-23 09:03 - 00004114 _____ () C:\Windows\PFRO.log
2014-03-28 19:49 - 2012-05-06 19:34 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-28 19:49 - 2012-05-06 19:34 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-28 17:21 - 2014-03-28 14:40 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-28 16:09 - 2014-03-28 16:08 - 00014937 _____ () C:\Users\Alannah\Downloads\Addition.txt
2014-03-28 16:09 - 2014-03-28 16:07 - 00038122 _____ () C:\Users\Alannah\Downloads\FRST.txt
2014-03-28 16:07 - 2014-03-28 16:06 - 02157056 _____ (Farbar) C:\Users\Alannah\Downloads\FRST64.exe
2014-03-28 15:43 - 2014-03-28 15:42 - 01038974 _____ (Thisisu) C:\Users\Alannah\Downloads\JRT.exe
2014-03-28 15:30 - 2013-08-30 17:10 - 00000000 ____D () C:\AdwCleaner
2014-03-28 15:26 - 2014-03-28 15:26 - 01950720 _____ () C:\Users\Alannah\Downloads\adwcleaner.exe
2014-03-28 15:13 - 2012-02-21 23:24 - 00000000 ____D () C:\Windows\sl
2014-03-28 14:40 - 2013-08-30 09:06 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-28 14:38 - 2014-03-28 14:37 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Alannah\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 22:17 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-27 16:11 - 2014-03-27 16:07 - 65446536 _____ (Microsoft Corporation) C:\Users\Alannah\Downloads\EIE11_DE-AT_MCM_WIN764.EXE
2014-03-27 14:45 - 2014-03-27 14:45 - 00020545 _____ () C:\ComboFix.txt
2014-03-27 14:45 - 2013-08-29 13:27 - 00000000 ____D () C:\Qoobox
2014-03-27 14:41 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-27 14:24 - 2014-03-27 14:24 - 00000000 ___RD () C:\Users\Alannah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-03-27 14:21 - 2014-03-27 14:09 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-03-27 14:16 - 2014-03-14 15:03 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\1H1Q
2014-03-23 09:04 - 2012-05-06 19:34 - 00000000 ____D () C:\Program Files (x86)\Google
2014-03-23 09:03 - 2014-03-23 09:03 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-22 22:46 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup
2014-03-22 19:54 - 2014-03-22 19:54 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Alannah\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-22 19:26 - 2012-02-22 00:21 - 00000000 ____D () C:\Intel
2014-03-22 19:22 - 2012-02-22 00:22 - 00000000 ____D () C:\ProgramData\Intel
2014-03-22 19:22 - 2012-02-21 23:31 - 00000000 ____D () C:\ProgramData\Adobe
2014-03-22 19:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-03-22 19:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Setup
2014-03-22 19:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-03-22 19:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\com
2014-03-22 19:19 - 2012-02-21 20:26 - 00000000 ____D () C:\Windows\Panther
2014-03-22 19:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\security
2014-03-22 19:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Registration
2014-03-22 19:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-03-22 19:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PLA
2014-03-22 19:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\IME
2014-03-22 19:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help
2014-03-22 19:17 - 2012-05-21 15:22 - 00000000 ____D () C:\Users\Alannah\.tfo4
2014-03-22 19:17 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-03-22 19:17 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\DVD Maker
2014-03-22 19:00 - 2014-03-22 19:00 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\ASCOMP Software
2014-03-22 18:59 - 2014-03-22 18:59 - 03640712 _____ (ASCOMP Software GmbH ) C:\Users\Alannah\Downloads\csuite21.exe
2014-03-22 18:55 - 2014-03-22 17:49 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-03-22 18:55 - 2014-03-22 17:46 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-03-22 17:49 - 2012-05-06 19:41 - 00000000 ____D () C:\Users\Alannah
2014-03-22 13:57 - 2014-03-22 13:57 - 00000000 ___RD () C:\Users\Alannah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-22 13:56 - 2014-03-22 13:40 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-22 13:54 - 2012-02-22 00:35 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-22 13:51 - 2014-03-22 13:51 - 00000000 ____D () C:\Users\Alannah\AppData\Local\Tuguu_SL
2014-03-22 13:40 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-03-22 13:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-03-16 19:55 - 2014-02-24 21:33 - 00000000 ____D () C:\Users\Alannah\AppData\Local\Windows Live
2014-03-16 19:28 - 2013-06-23 20:44 - 00000000 ____D () C:\Users\Alannah\Desktop\Rezepte
2014-03-15 20:52 - 2012-05-06 19:35 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-15 08:49 - 2012-05-06 19:42 - 00103984 _____ () C:\Users\Alannah\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-15 08:39 - 2009-07-14 06:45 - 00412736 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 17:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-03-14 15:33 - 2014-03-14 15:33 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-03-14 15:32 - 2014-03-14 15:31 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-03-14 15:29 - 2014-03-14 15:29 - 00000000 ____D () C:\Users\Alannah\redist
2014-03-14 15:29 - 2014-03-14 15:29 - 00000000 ____D () C:\Users\Alannah\readmes
2014-03-14 15:29 - 2014-03-14 15:29 - 00000000 ____D () C:\Users\Alannah\licenses
2014-03-14 15:28 - 2014-03-14 15:28 - 163606685 _____ () C:\Users\Alannah\Downloads\install-openoffice4.exe
2014-03-14 15:09 - 2014-03-14 15:09 - 00000000 ____D () C:\Users\Alannah\AppData\Roaming\OpenOffice
2014-03-14 14:10 - 2013-03-14 08:36 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-14 14:10 - 2013-03-14 08:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-14 14:02 - 2013-07-18 20:55 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-14 13:57 - 2012-02-21 21:44 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-12 18:50 - 2012-06-24 14:50 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 18:50 - 2012-06-24 14:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 18:50 - 2012-02-21 23:31 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-11 09:52 - 2012-03-20 20:44 - 00133928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NisDrvWFP.sys
2014-03-08 09:32 - 2013-08-14 18:34 - 00000000 ____D () C:\Users\Alannah\Desktop\MDE

Files to move or delete:
====================
C:\Users\Alannah\setup.exe


Some content of TEMP:
====================
C:\Users\Alannah\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-04 19:11

==================== End Of Log ============================
--- --- ---


Ich habe die Anzeige erhalten "No fixlist.txt found. The fixlist.txt should be in the same Folder/Directory the tool is located."


Sind noch irgendwo irgendwelche Viren oder sonst welche Dinge, die hier nichts zu suchen haben? Einlog-Probleme bei freenet oder web.de habe die etwas mit Trojanern zu tun oder mit der dusseligen Werbung, die zeitgleich mit dem Einloggen läuft? Ist wirklich total lästig.

schrauber 05.04.2014 11:09
Du hast entgegen der Anleitung FRST einfach ausgeführt, nicht gespeichert.

FRST neu laden, auf dem Desktop speichern
Fixlist auf dem Desktop speichern

dann geht das :)

hobgoblin 23.04.2014 06:23
Moin Moin,

richtiger Fixlist.txt?

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION


Anbei auch der Text von DelFix

Code:
# DelFix v10.6 - Datei am 23/04/2014 um 07:15:20 erstellt
# Aktualisiert am 11/11/2013 von Xplode
# Benutzer : Alannah - ALANNAH2
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Entferne die Bereinigungsprogramme ...

Gelöscht : C:\Qoobox
Gelöscht : C:\FRST
Gelöscht : C:\AdwCleaner
Gelöscht : C:\ComboFix.txt
Gelöscht : C:\Users\Alannah\Desktop\TFC.exe
Gelöscht : C:\Users\Alannah\Downloads\Addition.txt
Gelöscht : C:\Users\Alannah\Downloads\adwcleaner.exe
Gelöscht : C:\Users\Alannah\Downloads\FRST.txt
Gelöscht : C:\Users\Alannah\Downloads\FRST64.exe
Gelöscht : C:\Users\Alannah\Downloads\JRT.exe
Gelöscht : C:\Windows\grep.exe
Gelöscht : C:\Windows\PEV.exe
Gelöscht : C:\Windows\NIRCMD.exe
Gelöscht : C:\Windows\MBR.exe
Gelöscht : C:\Windows\SED.exe
Gelöscht : C:\Windows\SWREG.exe
Gelöscht : C:\Windows\SWSC.exe
Gelöscht : C:\Windows\SWXCACLS.exe
Gelöscht : C:\Windows\Zip.exe
Gelöscht : HKLM\SOFTWARE\OldTimer Tools
Gelöscht : HKLM\SOFTWARE\AdwCleaner
Gelöscht : HKLM\SOFTWARE\Swearware
Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

########## - EOF - ##########

Ich habe jetzt allerdings Probleme mit Java. bei jedem Seitenwechsel fragt mich das Programm ob ich Änderungen zulassen möchte.

Ist MSE denn wirklich so schlecht? Und welcher Schutz von Emsisoft wäre ratsam? Internet Security Pack oder Anti-Malware?

schrauber 23.04.2014 14:20
Wie Du willst, AntiMalware reicht aber.

Zeig mal nen Screenshot von der Java Meldung.


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:51 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27