Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Etwas mit dem Namen AVG blockiert zunehmend mein Opera (https://www.trojaner-board.de/155158-etwas-namen-avg-blockiert-zunehmend-opera.html)

MinniMaus 04.07.2014 14:01
Code:

       
Code:

       
HitmanPro 3.7.9.220
www.hitmanpro.com

   Computer name . . . . : ULLA
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Ulla\Neko
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2014-07-04 14:58:14
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1m 55s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 1
   Traces  . . . . . . . : 6

   Objects scanned . . . : 958.664
   Files scanned . . . . : 9.780
   Remnants scanned  . . : 158.295 files / 790.589 keys

Suspicious files ____________________________________________________________

   C:\Users\Neko\Downloads\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.081.792 bytes
      Age  . . . . . . . : 21.5 days (2014-06-13 03:52:38)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 0EA79E12416BF666C6010A50F9169FB1FB5B85682EB141F76B85595D3E132955
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 22.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

   C:\Users\Neko\Downloads\FRST64.exe
      Size . . . . . . . : 2.083.840 bytes
      Age  . . . . . . . : 0.0 days (2014-07-04 14:30:18)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : C0B38814FBC800F94241355B7FE8D437727C60F5CF846543FDB2638E3AF389A6
      Needs elevation  . : Yes
      Source URL . . . . : hxxp://download.bleepingcomputer.com/dl/0fd469e129dee7e797ee771862f4f80a/53b69e5d/windows/security/security-utilities/f/farbar-recovery-scan-tool/64/FRST64.exe
      Fuzzy  . . . . . . : 27.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         The file is downloaded from the Internet to this computer.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -1.1s C:\Users\Neko\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
         -0.2s C:\Users\Neko\AppData\Roaming\Microsoft\Windows\Cookies\C7GO9P5Z.txt
         -0.2s C:\Users\Neko\AppData\Roaming\Microsoft\Windows\Cookies\W214XUDZ.txt
         -0.2s C:\Users\Neko\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PF1V11VH\82[1].htm
          0.0s C:\Users\Neko\Downloads\FRST64.exe
          0.0s C:\Users\Neko\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1JXNJS80\FRST64[1].exe
          2.2s C:\Users\Neko\Downloads\FRST-OlderVersion\
          5.9s C:\Users\Neko\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4AQMPP2A\up64[1]


Malware remnants ____________________________________________________________

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6EC77D09-02CB-4E1F-E3C4-FB141B2610B3}\ (Activeris)

Potential Unwanted Programs _________________________________________________

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110511841188} (MediaPlayAIR)
   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110511841188} (MediaPlayAIR)
   HKLM\SOFTWARE\Wow6432Node\Taronja\ (MyStart)

deeprybka 04.07.2014 14:18
Hi,

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
Startup: C:\Users\Neko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopnotes.lnk
ShortcutTarget: Desktopnotes.lnk -> C:\Users\Neko\AppData\Local\Temp\Temp2_desknote.zip\desktopnotes.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
FF HKCU\...\Firefox\Extensions: [{68415527-0AA6-443B-EC2F-B09028DB8CF2}] - C:\Program Files (x86)\Re-markit-soft\171.xpi
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Fix-Button.
  • Das Tool erstellt eine "Fixlog.txt" -Datei.
  • Poste mir bitte deren Inhalt.

Schritt 2

In die Adresszeile von Opera folgenden Code reinkopieren und ENTER drücken:

Code:
opera://extensions
Alle unbekannten und nicht benötigten Erweiterungen löschen.

Anschließend:

Schritt 3
http://filepony.de/icon/opera.pngOpera: Browserdaten löschen
Kopiere bitte folgenden Text in die URL-Adresszeile Deines Opera-Browsers und drücke ENTER:
Code:
opera://settings/clearBrowserData
Setze überall Haken und drücke auf "Browserdaten löschen".
http://deeprybka.trojaner-board.de/opera/operacache.PNG

Schritt 4

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

MinniMaus 04.07.2014 14:48
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-07-2014
Ran by Neko at 2014-07-04 15:35:44 Run:1
Running from C:\Users\Neko\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Startup: C:\Users\Neko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopnotes.lnk
ShortcutTarget: Desktopnotes.lnk -> C:\Users\Neko\AppData\Local\Temp\Temp2_desknote.zip\desktopnotes.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
FF HKCU\...\Firefox\Extensions: [{68415527-0AA6-443B-EC2F-B09028DB8CF2}] - C:\Program Files (x86)\Re-markit-soft\171.xpi
       
*****************

C:\Users\Neko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopnotes.lnk => Moved successfully.
C:\Users\Neko\AppData\Local\Temp\Temp2_desknote.zip\desktopnotes.exe not found.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\{68415527-0AA6-443B-EC2F-B09028DB8CF2} => value deleted successfully.


The system needed a reboot.

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-07-2014
Ran by Neko (administrator) on ULLA on 04-07-2014 15:44:04
Running from C:\Users\Neko\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.70\opera.exe
() C:\Program Files (x86)\Opera\22.0.1471.70\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.70\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.70\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.70\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.70\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\22.0.1471.70\opera.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [zzzHPSETUP] => D:\Setup.exe
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [224128 2014-03-18] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x0ADD0A7A2453CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.5.2 - C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.5.2 - C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-03] (Avira Operations GmbH & Co. KG)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [122584 2014-07-01] (Malwarebytes Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-04 15:00 - 2014-07-04 15:00 - 00007968 _____ () C:\Users\Neko\Desktop\HitmanPro_20140704_1500.log
2014-07-04 14:57 - 2014-07-04 15:00 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-07-04 14:56 - 2014-07-04 14:57 - 11185664 _____ (SurfRight B.V.) C:\Users\Neko\Downloads\HitmanPro_x64.exe
2014-07-04 14:30 - 2014-07-04 14:30 - 00000000 ____D () C:\Users\Neko\Downloads\FRST-OlderVersion
2014-07-02 12:29 - 2014-07-04 15:36 - 00000280 _____ () C:\Windows\setupact.log
2014-07-02 12:29 - 2014-07-02 12:29 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-01 22:51 - 2014-07-01 22:51 - 00000000 _____ () C:\Users\Neko\Downloads\Download
2014-06-19 23:26 - 2014-06-19 23:26 - 00001027 _____ () C:\Users\Neko\Desktop\AdwCleaner[S2].txt
2014-06-13 22:37 - 2014-06-13 22:37 - 00036310 _____ () C:\Users\Neko\Desktop\FRST 2.txt
2014-06-13 22:37 - 2014-06-13 22:37 - 00022861 _____ () C:\Users\Neko\Desktop\Addition 1.txt
2014-06-13 20:41 - 2014-06-13 20:41 - 02347384 _____ (ESET) C:\Users\Neko\Downloads\esetsmartinstaller_deu.exe
2014-06-13 20:12 - 2014-06-13 20:12 - 00000909 _____ () C:\Users\Neko\Desktop\AdwCleaner[S1].txt
2014-06-13 04:18 - 2014-06-13 04:18 - 00035380 _____ () C:\Users\Neko\Desktop\FRST 1.txt
2014-06-13 04:18 - 2014-06-13 04:18 - 00017166 _____ () C:\Users\Neko\Desktop\Addition.txt
2014-06-13 03:53 - 2014-07-04 15:44 - 00005639 _____ () C:\Users\Neko\Downloads\FRST.txt
2014-06-13 03:53 - 2014-07-04 15:44 - 00000000 ____D () C:\FRST
2014-06-13 03:53 - 2014-07-04 14:37 - 00017103 _____ () C:\Users\Neko\Downloads\Addition.txt
2014-06-13 03:52 - 2014-07-04 14:30 - 02083840 _____ (Farbar) C:\Users\Neko\Downloads\FRST64.exe
2014-06-13 03:16 - 2014-07-01 22:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-13 03:15 - 2014-06-13 03:15 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-13 03:15 - 2014-06-13 03:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-13 03:15 - 2014-06-13 03:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-13 03:15 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-13 03:15 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-13 03:15 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-13 03:14 - 2014-06-13 03:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Neko\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-13 02:56 - 2014-06-19 23:24 - 00000000 ____D () C:\AdwCleaner
2014-06-13 02:56 - 2014-06-13 02:56 - 01333465 _____ () C:\Users\Neko\Downloads\adwcleaner_3.212.exe
2014-06-13 00:48 - 2014-07-04 15:36 - 00631231 _____ () C:\Windows\WindowsUpdate.log
2014-06-13 00:39 - 2014-06-13 00:42 - 00000022 _____ () C:\Users\Neko\Downloads\avg_remover4116.zip
2014-06-13 00:39 - 2014-06-13 00:39 - 03453210 _____ () C:\Users\Neko\Downloads\avg_remover4116 (1).zip
2014-06-13 00:21 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-13 00:21 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-13 00:21 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-13 00:21 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-13 00:21 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-13 00:21 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-13 00:21 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-13 00:21 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-13 00:21 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-13 00:21 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-13 00:21 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-13 00:21 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-13 00:21 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-13 00:21 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-13 00:21 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-13 00:21 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-13 00:21 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-13 00:21 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-13 00:21 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-13 00:21 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-13 00:21 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-13 00:21 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-13 00:21 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-13 00:21 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-13 00:21 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-13 00:21 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-13 00:21 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-13 00:21 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-13 00:21 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-13 00:21 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-13 00:21 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-13 00:21 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-13 00:21 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-13 00:21 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-13 00:21 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-13 00:21 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-13 00:21 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-13 00:21 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-13 00:21 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-13 00:21 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-13 00:21 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-13 00:21 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-13 00:21 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-13 00:21 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-13 00:21 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-13 00:21 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-13 00:21 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-13 00:21 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-13 00:21 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-13 00:21 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-13 00:21 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-13 00:21 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-13 00:21 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-13 00:21 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-13 00:21 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-13 00:21 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-13 00:21 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-13 00:21 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-13 00:21 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-13 00:21 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-13 00:21 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-13 00:21 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-13 00:21 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-13 00:21 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-05 03:52 - 2014-06-05 03:52 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-06-05 03:52 - 2014-06-05 03:52 - 00176040 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-06-05 03:52 - 2014-06-05 03:52 - 00176040 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-06-05 03:52 - 2014-06-05 03:52 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-06-05 03:52 - 2014-06-05 03:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-05 03:51 - 2014-06-05 03:52 - 00000000 ____D () C:\Program Files (x86)\Java
2014-06-05 03:51 - 2014-06-05 03:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2014-06-05 03:46 - 2014-06-05 03:49 - 159077280 _____ (Oracle Corporation) C:\Users\Neko\Downloads\jdk-8u5-windows-i586.exe
2014-06-05 03:14 - 2014-06-05 03:14 - 00000000 __SHD () C:\Users\Neko\AppData\Local\EmieUserList
2014-06-05 03:14 - 2014-06-05 03:14 - 00000000 __SHD () C:\Users\Neko\AppData\Local\EmieSiteList

==================== One Month Modified Files and Folders =======

2014-07-04 15:44 - 2014-06-13 03:53 - 00005639 _____ () C:\Users\Neko\Downloads\FRST.txt
2014-07-04 15:44 - 2014-06-13 03:53 - 00000000 ____D () C:\FRST
2014-07-04 15:44 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-04 15:44 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-04 15:40 - 2014-06-13 00:48 - 00631231 _____ () C:\Windows\WindowsUpdate.log
2014-07-04 15:37 - 2014-06-02 02:47 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-07-04 15:36 - 2014-07-02 12:29 - 00000280 _____ () C:\Windows\setupact.log
2014-07-04 15:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-04 15:35 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-07-04 15:00 - 2014-07-04 15:00 - 00007968 _____ () C:\Users\Neko\Desktop\HitmanPro_20140704_1500.log
2014-07-04 15:00 - 2014-07-04 14:57 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-07-04 14:57 - 2014-07-04 14:56 - 11185664 _____ (SurfRight B.V.) C:\Users\Neko\Downloads\HitmanPro_x64.exe
2014-07-04 14:37 - 2014-06-13 03:53 - 00017103 _____ () C:\Users\Neko\Downloads\Addition.txt
2014-07-04 14:30 - 2014-07-04 14:30 - 00000000 ____D () C:\Users\Neko\Downloads\FRST-OlderVersion
2014-07-04 14:30 - 2014-06-13 03:52 - 02083840 _____ (Farbar) C:\Users\Neko\Downloads\FRST64.exe
2014-07-03 16:01 - 2014-04-24 21:02 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-07-02 12:29 - 2014-07-02 12:29 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-01 22:59 - 2014-06-13 03:16 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 22:51 - 2014-07-01 22:51 - 00000000 _____ () C:\Users\Neko\Downloads\Download
2014-06-19 23:31 - 2014-06-03 17:20 - 00003842 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1396959634
2014-06-19 23:31 - 2014-04-08 14:20 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-06-19 23:26 - 2014-06-19 23:26 - 00001027 _____ () C:\Users\Neko\Desktop\AdwCleaner[S2].txt
2014-06-19 23:24 - 2014-06-13 02:56 - 00000000 ____D () C:\AdwCleaner
2014-06-19 21:21 - 2014-06-02 13:46 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-19 21:21 - 2014-06-02 13:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-15 23:08 - 2011-04-12 09:43 - 00699552 _____ () C:\Windows\system32\perfh007.dat
2014-06-15 23:08 - 2011-04-12 09:43 - 00149660 _____ () C:\Windows\system32\perfc007.dat
2014-06-15 23:08 - 2009-07-14 07:13 - 01620152 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-13 22:37 - 2014-06-13 22:37 - 00036310 _____ () C:\Users\Neko\Desktop\FRST 2.txt
2014-06-13 22:37 - 2014-06-13 22:37 - 00022861 _____ () C:\Users\Neko\Desktop\Addition 1.txt
2014-06-13 20:41 - 2014-06-13 20:41 - 02347384 _____ (ESET) C:\Users\Neko\Downloads\esetsmartinstaller_deu.exe
2014-06-13 20:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-06-13 20:12 - 2014-06-13 20:12 - 00000909 _____ () C:\Users\Neko\Desktop\AdwCleaner[S1].txt
2014-06-13 04:18 - 2014-06-13 04:18 - 00035380 _____ () C:\Users\Neko\Desktop\FRST 1.txt
2014-06-13 04:18 - 2014-06-13 04:18 - 00017166 _____ () C:\Users\Neko\Desktop\Addition.txt
2014-06-13 03:15 - 2014-06-13 03:15 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-13 03:15 - 2014-06-13 03:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-13 03:15 - 2014-06-13 03:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-13 03:15 - 2014-06-13 03:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Neko\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-13 02:58 - 2014-04-26 13:34 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-13 02:56 - 2014-06-13 02:56 - 01333465 _____ () C:\Users\Neko\Downloads\adwcleaner_3.212.exe
2014-06-13 02:56 - 2014-04-26 13:34 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-13 00:42 - 2014-06-13 00:39 - 00000022 _____ () C:\Users\Neko\Downloads\avg_remover4116.zip
2014-06-13 00:39 - 2014-06-13 00:39 - 03453210 _____ () C:\Users\Neko\Downloads\avg_remover4116 (1).zip
2014-06-10 18:48 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-05 03:52 - 2014-06-05 03:52 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-06-05 03:52 - 2014-06-05 03:52 - 00176040 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-06-05 03:52 - 2014-06-05 03:52 - 00176040 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-06-05 03:52 - 2014-06-05 03:52 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-06-05 03:52 - 2014-06-05 03:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-05 03:52 - 2014-06-05 03:51 - 00000000 ____D () C:\Program Files (x86)\Java
2014-06-05 03:51 - 2014-06-05 03:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2014-06-05 03:49 - 2014-06-05 03:46 - 159077280 _____ (Oracle Corporation) C:\Users\Neko\Downloads\jdk-8u5-windows-i586.exe
2014-06-05 03:36 - 2014-06-02 13:53 - 00000000 ____D () C:\Users\Neko\Downloads\bin
2014-06-05 03:14 - 2014-06-05 03:14 - 00000000 __SHD () C:\Users\Neko\AppData\Local\EmieUserList
2014-06-05 03:14 - 2014-06-05 03:14 - 00000000 __SHD () C:\Users\Neko\AppData\Local\EmieSiteList

Some content of TEMP:
====================
C:\Users\Neko\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-25 09:40

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Übrigends sind die "Ads by OnlineBrowser Advertising" nch immer da. Was kann ich gegen die tun?

deeprybka 04.07.2014 14:51
Schritt 1
  • Schließe alle offenen Programme und Browser.
  • Starte bitte http://filepony.de/icon/adwcleaner.png Adwarecleaner.
  • Akzeptiere die Nutzungsbedingungen.
  • Klicke auf Suchen und warte, bis der Suchlauf abgeschlossen ist.
  • Klicke nun auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
    Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Sx].txt. (x = fortlaufende Nummer).

MinniMaus 04.07.2014 15:02
Nein! Das hat nichts gebracht. Gibt es noch einen anderen Weg?

Code:
# AdwCleaner v3.214 - Bericht erstellt am 04/07/2014 um 15:58:07
# Aktualisiert 29/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Neko - ULLA
# Gestartet von : C:\Users\Neko\Downloads\adwcleaner_3.214.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126


*************************

AdwCleaner[R0].txt - [672 octets] - [13/06/2014 02:56:36]
AdwCleaner[R1].txt - [790 octets] - [13/06/2014 03:01:48]
AdwCleaner[R2].txt - [849 octets] - [13/06/2014 20:09:47]
AdwCleaner[R3].txt - [967 octets] - [19/06/2014 23:23:53]
AdwCleaner[R4].txt - [1087 octets] - [04/07/2014 15:56:50]
AdwCleaner[S0].txt - [732 octets] - [13/06/2014 02:57:00]
AdwCleaner[S1].txt - [909 octets] - [13/06/2014 20:10:56]
AdwCleaner[S2].txt - [1027 octets] - [19/06/2014 23:24:14]
AdwCleaner[S3].txt - [1009 octets] - [04/07/2014 15:58:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1069 octets] ##########

deeprybka 04.07.2014 15:22
Installier mal das bitte:
https://addons.opera.com/de/extensio...ck/?display=de

MinniMaus 04.07.2014 15:34
Danke. Habe ich jetzt. Ich habe es kurz Ausprobiert, doch ich versteh es nicht.
Könntest du es bitte erklären? Und da sind so Zahlen. Wenn diese, die Anzahl der Ads bestimmen oder was anderes, verschwinden sie auch einmal, oder bleiben sie einfach?

deeprybka 04.07.2014 15:39
Sorry,
ich verstehe nicht was genau für ein Problem vorliegt. Hast Du jetzt noch Probleme mit Opera?

MinniMaus 04.07.2014 15:43
Nein. So nicht. Ich frage nur, was die Nummer bedeutet, unter diesem ABP-Symbol. und die Ads sind auch nicht ganz verschwunden. Sie zeigen nur keine Werbung mehr und sind durchsichtige Kästchen.
Ich wollte nur wissen, ob das richtig ist, mit den Kästchen.

deeprybka 04.07.2014 16:09
Sorry, kann ich schwer aus der Ferne einschätzen was Du meinst.

Lade Dir bitte Revo Uninstallerhttp://deeprybka.trojaner-board.de/b...ninstaller.pnghier herunter. Entpacke die zip-Datei auf den Desktop.
Dann lade Dir Opera neu herunter.
Opera - Download - Filepony

http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

MinniMaus 04.07.2014 22:56
Nein!
Es hat etwas gedauert, wegen Fußball und weil ich Genau sein wollte, ob diese Ads wirklich verschwunden sind,doch sie sind alle weg.

Hab vielen, lieben Dank! Sollten in Zukunft nochmals solche Sachen passieren, weiß ich nun, wie ich vorzugehen habe. Wenn ich dann doch mal keine Lösung weiß, wende ich mich wieder hier an das Trojaner-Board.

Danke, Danke, Danke,
deine Minni

deeprybka 04.07.2014 23:01
Ok... ;)


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:47 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131