Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Virenbefall Windows 8.1 64 bit Comodo. Dringend Trojaner bereits Internet Verbindung (https://www.trojaner-board.de/168332-virenbefall-windows-8-1-64-bit-comodo-dringend-trojaner-bereits-internet-verbindung.html)

vanmoretti 09.07.2015 19:28
Hallo,

es kommt mir langsam etwas wie Schikane vor. Ich habe doch die Scan files in einer .txt-Datei eingefügt, da die hier beschriebene Vorgehensweise sich zwar toll anhört, aber die maximal zulässige Textmenge es leider nicht hergibt.

Ich poste die SCANs dann als einzelne txt-files falls es das Ganze einfacher macht.
Die Codes die gehen stelle ich direkt ein.

Könntest du dann versuchen auch meine Fragen bezüglich des Schädlings zu beantworten. Damit ich weiß, ob Passwörter, Accounts usw. geändert werden müssen oder was der Virus genau anstellt.

Danke.

vanmoretti 09.07.2015 19:31
Liste der Anhänge anzeigen (Anzahl: 1)
Hier die FRST.

Info: CODE zu laaaaaang.

vanmoretti 09.07.2015 19:41
Addition

Info: CODE zu laaaaaang. Und .txt zu groß.

vanmoretti 09.07.2015 19:46
Info: CODE zu laaaaaang. Und .txt zu groß.

M-K-D-B 10.07.2015 20:50
Du bist ja lustig... du möchtest Hilfe, postest aber nicht die richtigen Logdateien und beschwerst dich noch... ich sehe viele unnötige Programme, aber keine Malware.


Wir schauen mal, ob die folgenden Tools laufen und was finden:



Schritt 1
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).






Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.







Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.







Schritt 4
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
  • FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
  • Poste mir beide Logdateien mit deiner nächsten Antwort.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei von AdwCleaner,
  • die Logdatei von MBAM,
  • die Logdatei von JRT,
  • die beiden neuen Logdateien von FRST.

vanmoretti 11.07.2015 11:08
AdwCleaner Logfile:
Code:
# AdwCleaner v4.208 - Bericht erstellt 11/07/2015 um 12:02:57
# Aktualisiert 09/07/2015 von Xplode
# Datenbank : 2015-07-09.2 [Lokal]
# Betriebssystem : Windows 8.1 Pro  (x64)
# Benutzername : a - a-PC
# Gestarted von : C:\Users\a\Desktop\AdwCleaner_4.208.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v38.0.5 (x86 de)


-\\ Google Chrome v43.0.2357.132


*************************

AdwCleaner[R0].txt - [4837 Bytes] - [09/07/2015 21:40:31]
AdwCleaner[R1].txt - [939 Bytes] - [09/07/2015 21:49:37]
AdwCleaner[R2].txt - [1051 Bytes] - [11/07/2015 11:44:09]
AdwCleaner[R3].txt - [1169 Bytes] - [11/07/2015 11:47:17]
AdwCleaner[R4].txt - [1287 Bytes] - [11/07/2015 12:01:52]
AdwCleaner[S0].txt - [4650 Bytes] - [09/07/2015 21:42:31]
AdwCleaner[S1].txt - [997 Bytes] - [09/07/2015 21:50:37]
AdwCleaner[S2].txt - [1111 Bytes] - [11/07/2015 11:45:16]
AdwCleaner[S3].txt - [1229 Bytes] - [11/07/2015 11:48:31]
AdwCleaner[S4].txt - [1208 Bytes] - [11/07/2015 12:02:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1267  Bytes] ##########
--- --- ---


ADW Cleaner scheint nichts mehr zu finden.
Allerdings hat Kaspersky irgendwann folgende Schadsoftware gezeigt:

pup.riskwaretool.ck virus

vanmoretti 11.07.2015 11:33
Liste der Anhänge anzeigen (Anzahl: 1)
Malwarebytes stürzt leider auch wie alle anderen Antivirenprogramme immer bei der selben Datei im Suchlauf ab. Ich habe deshalb bereits vorher schon bei der ersten Bedrohung ein Screenshot gemacht. Im Anhang.

Ich versuche es nochmal im abgesicherten Modus.

M-K-D-B 11.07.2015 11:36
Servus,


der Fund von MBAM zeigt auf die Quarantäne von Combodo, also nichts. ;)

Poste bitte noch die anderen Logdateien, wenn möglich.

vanmoretti 11.07.2015 12:04
Bei folgendem Pfad stürzt Malwarebytes (auch im abgesicherten Modus) immer ab. Da ich den Taskmanager nebenei offen habe immer folgende Beobachtung:

Malwarebytes führt den Suchlauf durch. Prozessorauslatung konstant bei 18-20%.

Bei folgendem Pfad: "c:\windows\microsoft.net\framework\v.2.0.50727\system.dll" zeigt der Taskmanager eine Auslastung von 1% und dann 0% an.

-> anschließend vollständiger System Freeze mit schwarzem Bildschirm.

Ich werde die anderen jetzt probieren und dann die Logs posten.

M-K-D-B 11.07.2015 12:05
ok :)

vanmoretti 11.07.2015 12:28
JRT Logfile:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.4.2 (07.10.2015:3)
OS: Windows 8.1 Pro x64
Ran by a on 11.07.2015 at 13:06:59,14
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\privdogservice



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\myfree codec



~~~ FireFox

Successfully deleted the following from C:\Users\konvicto\AppData\Roaming\mozilla\firefox\profiles\h4ij53us.default\prefs.js

user_pref(extensions.trusted-ads.list_api, {\r\:[\hxxp://a1supplements.com/\,\hxxp://aactionair.net/\,\hxxp://airservicesrefrigeration.com/\,\hxxp://ajperri.com/\
Emptied folder: C:\Users\konvicto\AppData\Roaming\mozilla\firefox\profiles\h4ij53us.default\minidumps [7 files]



~~~ Chrome


[C:\Users\konvicto\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\konvicto\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\konvicto\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\konvicto\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.07.2015 at 13:14:55,49
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---


Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:11-07-2015
Ran by a (administrator) on KONVICT-PC on 11-07-2015 13:22:53
Running from C:\Users\a\Desktop
Loaded Profiles: a (Available Profiles: konvicto & Silver & .NET v4.5 & DefaultAppPool & .NET v4.5 Classic)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avpui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Intel Corporation) C:\Program Files\PTC\Creo 3.0\M030\Common Files\x86e_win64\cma\Bin\IntelMPI\smpd-intel-4.0.3.009-x64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2012-09-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-09-14] (Realtek Semiconductor)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17079376 2013-04-22] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191568 2013-04-22] (Lenovo(beijing) Limited)
HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [665400 2012-08-27] (Synaptics)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-27] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-02-19] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1427648 2015-06-10] (COMODO)
HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cis5D96.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-07-09] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [AntiLogger] => C:\Program Files (x86)\AntiLogger\AntiLogger.exe [14268328 2014-11-06] (Zemana Ltd.)
HKLM-x32\...\Run: [GamingMouse] => C:\Program Files (x86)\Drakonia Configurator\hid.exe [248832 2013-10-29] ()
HKLM-x32\...\Run: [ComodoFSFirefox] => "C:\Program Files (x86)\AdTrustMedia\PrivDog\FinalizeSetup.exe" /f
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [NuTCSetupEnviron] => C:\Program Files\PTC\MKS Toolkit\bin\ncoeenv.exe [37248 2015-04-06] (MKS Software Inc.)
HKLM-x32\...\Run: [KeyScrambler] => C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [509216 2015-06-17] (QFX Software Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\...\MountPoints2: {5e4efe84-54b3-11e4-be9f-2089843b3022} - "H:\EasySuite.exe"
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\...\MountPoints2: {5e4efed8-54b3-11e4-be9f-2089843b3022} - "H:\EasySuite.exe"
AppInit_DLLs: C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [177624 2015-02-19] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [164752 2015-02-19] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2013-04-22]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks 2014 Schnellstart.lnk [2014-05-09]
ShortcutTarget: SolidWorks 2014 Schnellstart.lnk -> C:\Windows\Installer\{4FFA60C4-9A8B-4C9E-8265-2241B266304C}\NewShortcut2_87EDF6C81D0A4B7B84F42FE0C6A9D608.exe (Flexera Software LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks Hintergrund-Downloader.lnk [2014-05-09]
ShortcutTarget: SolidWorks Hintergrund-Downloader.lnk -> C:\Program Files (x86)\Common Files\SolidWorks Installations-Manager\BackgroundDownloading\sldBgDwld.exe (Dassault Systèmes SolidWorks Corp.)
Startup: C:\Users\konvicto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-01-27]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1110200231-202011538-1979519991-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://t.de.msn.com/
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKU\S-1-5-21-1110200231-202011538-1979519991-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.google.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-07-03] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-28] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-28] (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll No File
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-07-03] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-28] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2014-12-17] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-28] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{27BFD224-FAA4-4867-A976-7FAFE5B30176}: [NameServer] 156.154.70.22,156.154.71.22
Tcpip\..\Interfaces\{27BFD224-FAA4-4867-A976-7FAFE5B30176}: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{593BCFC9-08FB-4176-A218-33BF49636B06}: [NameServer] 156.154.70.22,156.154.71.22
Tcpip\..\Interfaces\{593BCFC9-08FB-4176-A218-33BF49636B06}: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\konvicto\AppData\Roaming\Mozilla\Firefox\Profiles\h4ij53us.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_191.dll [2015-07-08] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-28] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-28] (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2013-04-08] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_191.dll [2015-07-08] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-28] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com [2015-07-04] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2015-07-04] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @ptc.com/IsoView -> C:\Program Files (x86)\Common Files\PTC\npisoview.dll [2014-10-29] (PTC Inc.)
FF Plugin-x32: @ptc.com/ProductViewLite -> C:\Program Files (x86)\Common Files\PTC\np6_pvapplite9.dll [2014-10-29] (PTC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-1110200231-202011538-1979519991-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2014-10-28] (Tracker Software Products (Canada) Ltd.)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\konvicto\AppData\Roaming\Mozilla\Firefox\Profiles\h4ij53us.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-03-19]
FF Extension: DownThemAll! - C:\Users\konvicto\AppData\Roaming\Mozilla\Firefox\Profiles\h4ij53us.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-01-21]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com [2015-07-03]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2015-07-03]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com [2015-07-03]

Chrome:
=======
CHR Profile: C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-15]
CHR Extension: (Google Drive) - C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-15]
CHR Extension: (YouTube) - C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-15]
CHR Extension: (Google Search) - C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-30]
CHR Extension: (Google Wallet) - C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-15]
CHR Extension: (Gmail) - C:\Users\konvicto\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-15]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2015-04-15] (Microsoft Corporation)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [953720 2012-08-17] (Broadcom Corporation.)
S2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5541960 2015-06-10] (COMODO)
S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-02-19] (NVIDIA Corporation)
S2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-07-09] (Intel Corporation) [File not signed]
R2 impi_smpd; C:\Program Files\PTC\Creo 3.0\M030\Common Files\x86e_win64\cma\Bin\IntelMPI\smpd-intel-4.0.3.009-x64.exe [1611168 2015-04-03] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-07-18] ()
S2 NuTCRACKERService; C:\WINDOWS\system32\nutsrv4.exe [574776 2015-04-06] (MKS Software Inc.)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-02-19] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-02-19] (NVIDIA Corporation)
S2 PortmapperService; C:\Program Files\PTC/PTC Portmapper/i486_nt/obj/portmap.exe [499712 2015-04-06] (PTC Inc.) [File not signed]
S2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [186056 2013-10-16] (Sandboxie Holdings, LLC)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
S3 SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2014-05-09] (SolidWorks) [File not signed]
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-03-12] (Microsoft Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [546304 2014-03-12] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-03-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-03-10] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2699568 2012-07-18] (Intel® Corporation)
S2 Privacy Content Firewall; "C:\Program Files\AdTrustMedia\PrivDog\3.0.108.0\PrivDogService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 admnfd; C:\WINDOWS\system32\Drivers\admnfd.sys [49496 2014-12-04] (Windows (R) Win 7 DDK provider)
R1 AntiLog32; C:\WINDOWS\system32\drivers\AntiLog64.sys [49752 2014-11-11] (Zemana Ltd.)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.)
R1 browserMon; C:\Windows\System32\DRIVERS\browserMon.sys [20728 2015-02-26] (Windows (R) Win 7 DDK provider)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [820928 2015-06-05] (COMODO)
R1 cmdhlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [35056 2015-06-05] (COMODO)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-01-23] (Disc Soft Ltd)
R3 keycrypt; C:\Windows\System32\DRIVERS\KeyCrypt64.sys [25056 2013-12-12] (Zemana Ltd.)
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [224208 2015-06-03] (QFX Software Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2015-07-04] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2015-07-04] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
S3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [109272 2015-06-18] (Malwarebytes Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-11] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-02-19] (NVIDIA Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8229264 2012-09-28] (Realtek Semiconductor Corp.)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [200552 2013-10-16] (Sandboxie Holdings, LLC)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-27] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-03-10] (Microsoft Corporation)
U3 DfSdkS; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-11 13:22 - 2015-07-11 13:23 - 00025417 _____ C:\Users\konvicto\Desktop\FRST.txt
2015-07-11 13:22 - 2015-07-11 13:22 - 00000000 ____D C:\Users\konvicto\Desktop\FRST-OlderVersion
2015-07-11 13:14 - 2015-07-11 13:14 - 00001690 _____ C:\Users\konvicto\Desktop\JRT.txt
2015-07-11 13:06 - 2015-07-11 13:06 - 03034370 _____ (Malwarebytes Corporation) C:\Users\konvicto\Desktop\JRT.exe
2015-07-11 12:10 - 2015-07-11 12:10 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\konvicto\Desktop\mbam-setup-2.1.6.1022.exe
2015-07-11 11:43 - 2015-07-11 11:43 - 02248704 _____ C:\Users\konvicto\Desktop\AdwCleaner_4.208.exe
2015-07-09 21:40 - 2015-07-11 12:02 - 00000000 ____D C:\AdwCleaner
2015-07-09 21:05 - 2015-07-09 21:05 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-09 21:05 - 2015-07-09 21:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-09 21:05 - 2015-07-09 21:05 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-09 21:05 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-07-09 21:05 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-07-09 20:50 - 2015-07-09 20:53 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\konvicto\Desktop\mbam-setup-2.1.8.1057.exe
2015-07-09 20:42 - 2015-07-09 20:42 - 00056755 _____ C:\Users\konvicto\Desktop\tdsskiller.zip
2015-07-09 20:40 - 2015-07-09 20:40 - 00040495 _____ C:\Users\konvicto\Desktop\Addition.zip
2015-07-07 21:49 - 2014-04-16 01:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-07-07 21:49 - 2014-04-16 01:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-07-07 21:35 - 2015-07-07 21:35 - 00000046 _____ C:\WINDOWS\wininit.ini
2015-07-07 20:54 - 2015-07-07 20:54 - 00000000 ____D C:\TDSSKiller_Quarantine
2015-07-07 00:14 - 2015-07-07 00:14 - 02965768 _____ (Acresso Software Inc. ) C:\Users\konvicto\Desktop\SafenSoft_SysWatch_CB-DL-Manager.exe
2015-07-07 00:11 - 2015-07-07 00:11 - 02965768 _____ (Acresso Software Inc. ) C:\Users\konvicto\Desktop\e73f19hl_CB-DL-Manager.exe
2015-07-05 23:18 - 2015-07-05 23:18 - 00000000 __SHD C:\found.001
2015-07-05 22:38 - 2015-07-09 21:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-05 22:37 - 2015-07-11 12:52 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-07-05 22:37 - 2015-07-09 22:08 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-07-05 22:33 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-07-05 22:32 - 2015-07-09 22:08 - 00000000 ____D C:\Users\konvicto\Desktop\mbar
2015-07-05 22:30 - 2015-07-05 22:31 - 16502728 _____ (Malwarebytes Corp.) C:\Users\konvicto\Desktop\mbar-1.09.1.1004.exe
2015-07-05 16:03 - 2015-07-09 20:40 - 00256410 _____ C:\Users\konvicto\Desktop\tdsskiller.txt
2015-07-03 00:59 - 2015-07-03 00:59 - 00001163 _____ C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2015-07-03 00:59 - 2015-07-03 00:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2015-07-03 00:58 - 2015-07-11 12:52 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-07-03 00:58 - 2015-07-04 01:26 - 00771272 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\klif.sys
2015-07-03 00:58 - 2015-07-04 01:26 - 00142344 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\klflt.sys
2015-07-03 00:58 - 2015-07-03 00:58 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-07-03 00:58 - 2014-04-10 17:25 - 00243808 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\klhk.sys
2015-07-03 00:58 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\klfphc.dll
2015-06-30 23:01 - 2015-07-11 13:22 - 00000000 ____D C:\FRST
2015-06-30 23:00 - 2015-07-11 13:22 - 02130944 _____ (Farbar) C:\Users\konvicto\Desktop\FRST64.exe
2015-06-30 23:00 - 2015-06-30 23:00 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\konvicto\Desktop\tdsskiller.exe
2015-06-28 20:51 - 2015-06-28 20:51 - 00000416 _____ C:\WINDOWS\Tasks\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}.job
2015-06-28 20:50 - 2015-06-28 20:50 - 00000000 __SHD C:\found.000
2015-06-28 20:00 - 2015-06-28 20:00 - 00000000 ____D C:\ProgramData\Comodo Downloader
2015-06-14 02:37 - 2015-06-14 02:37 - 03633664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 02749952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 02483712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 01920000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 01430528 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 01249280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 01119232 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 01020928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00903168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2015-06-14 02:37 - 2015-06-14 02:37 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2015-06-14 02:37 - 2015-06-14 02:37 - 00700416 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00699392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00468480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2015-06-14 02:37 - 2015-06-14 02:37 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2015-06-14 02:37 - 2015-06-14 02:37 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\authz.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00272896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2015-06-14 02:37 - 2015-06-14 02:37 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssphtb.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00222208 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastapi.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastapi.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authz.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00158720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rgb9rast.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-06-14 02:37 - 2015-06-14 02:37 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-06-14 02:37 - 2015-04-09 00:07 - 00410336 _____ C:\WINDOWS\system32\ApnDatabase.xml

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-11 13:07 - 2014-06-15 13:31 - 00001140 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-11 13:06 - 2014-01-09 17:19 - 00000000 __RDO C:\Users\konvicto\SkyDrive
2015-07-11 13:03 - 2015-02-03 20:16 - 01980855 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-11 13:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-07-11 12:59 - 2013-11-14 09:26 - 02447902 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-07-11 12:59 - 2013-11-14 09:11 - 01161892 _____ C:\WINDOWS\system32\perfh007.dat
2015-07-11 12:59 - 2013-11-14 09:11 - 00296500 _____ C:\WINDOWS\system32\perfc007.dat
2015-07-11 12:56 - 2014-03-11 11:08 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-07-11 12:52 - 2015-05-23 18:43 - 00020136 _____ C:\WINDOWS\setupact.log
2015-07-11 12:52 - 2014-06-15 13:31 - 00001136 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-11 12:52 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-07-11 12:29 - 2014-01-09 17:04 - 00000000 ____D C:\Users\konvicto
2015-07-11 11:45 - 2013-08-22 15:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-07-11 11:40 - 2015-02-15 12:51 - 00000000 ____D C:\WINDOWS\Minidump
2015-07-11 11:40 - 2013-04-19 21:53 - 00304442 ____N C:\WINDOWS\Minidump\071115-9781-01.dmp
2015-07-09 21:22 - 2015-05-27 22:51 - 00214338 _____ C:\WINDOWS\PFRO.log
2015-07-09 19:23 - 2013-04-19 21:53 - 00322480 ____N C:\WINDOWS\Minidump\070915-19875-01.dmp
2015-07-09 19:08 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-07-09 00:48 - 2013-04-19 21:53 - 00304016 ____N C:\WINDOWS\Minidump\070915-14078-01.dmp
2015-07-09 00:47 - 2013-04-20 09:59 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1110200231-202011538-1979519991-1001
2015-07-08 23:08 - 2014-06-15 13:32 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-08 22:56 - 2014-03-11 11:08 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-07-07 22:04 - 2013-04-23 21:34 - 00000000 ____D C:\Users\konvicto\Desktop\Programme
2015-07-07 21:36 - 2013-05-01 20:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\COMODO
2015-07-07 21:36 - 2013-05-01 20:35 - 00000000 ____D C:\Program Files (x86)\COMODO
2015-07-07 21:32 - 2013-05-01 20:39 - 00000000 ____D C:\Users\konvicto\AppData\Local\Comodo
2015-07-07 20:39 - 2014-10-25 15:36 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-07 00:14 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-07-06 23:24 - 2014-04-30 13:09 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-07-06 23:24 - 2014-04-30 13:09 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-06 22:12 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\SchCache
2015-07-04 03:11 - 2014-09-22 18:11 - 00000000 ____D C:\Users\Silver
2015-07-04 03:11 - 2014-04-04 22:43 - 00000000 ____D C:\Users\DefaultAppPool
2015-07-04 03:11 - 2014-03-12 23:52 - 00000000 ____D C:\Users\.NET v4.5 Classic
2015-07-04 03:11 - 2014-03-12 23:52 - 00000000 ____D C:\Users\.NET v4.5
2015-07-04 03:07 - 2015-02-19 22:07 - 00000000 ____D C:\WINDOWS\SysWOW64\NV
2015-07-04 03:07 - 2015-02-19 22:07 - 00000000 ____D C:\WINDOWS\system32\NV
2015-07-03 00:58 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2015-07-03 00:17 - 2013-08-22 16:44 - 00436408 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-07-02 23:33 - 2013-04-23 23:08 - 00000000 ____D C:\ProgramData\Adobe
2015-07-02 23:32 - 2015-01-24 03:32 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-07-02 23:12 - 2013-04-19 21:53 - 00289072 ____N C:\WINDOWS\Minidump\070215-8281-01.dmp
2015-07-02 00:25 - 2013-04-19 21:53 - 00289584 ____N C:\WINDOWS\Minidump\070215-8906-01.dmp
2015-06-28 20:26 - 2013-05-01 20:40 - 01474832 _____ C:\WINDOWS\system32\Drivers\sfi.dat
2015-06-28 19:33 - 2014-02-14 13:46 - 00000000 ____D C:\ProgramData\Oracle
2015-06-28 19:32 - 2015-01-29 22:33 - 00110688 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2015-06-28 19:32 - 2014-10-20 20:09 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-06-28 19:32 - 2014-10-20 20:09 - 00000000 ____D C:\Program Files (x86)\Java
2015-06-28 19:32 - 2014-07-18 15:53 - 00000000 ____D C:\Program Files\Java
2015-06-28 03:28 - 2013-04-19 21:53 - 00299692 ____N C:\WINDOWS\Minidump\062815-9203-01.dmp
2015-06-21 11:30 - 2014-01-09 18:23 - 00003336 _____ C:\WINDOWS\Sandboxie.ini
2015-06-20 13:45 - 2015-04-19 19:34 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-06-20 13:45 - 2015-04-19 19:30 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-06-20 13:45 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-06-20 13:44 - 2013-04-19 21:53 - 00297132 ____N C:\WINDOWS\Minidump\062015-9640-01.dmp
2015-06-19 19:08 - 2015-05-31 01:05 - 00000000 ____D C:\Users\konvicto\Desktop\Widerspruch & Rechtstreit
2015-06-19 00:13 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-06-18 00:28 - 2014-01-08 12:29 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-06-18 00:25 - 2013-04-22 21:58 - 140135120 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-06-17 23:06 - 2013-04-23 22:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeyScrambler
2015-06-17 23:06 - 2013-04-23 22:16 - 00000000 ____D C:\Program Files (x86)\KeyScrambler
2015-06-14 02:37 - 2013-11-14 09:21 - 02473472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2015-06-14 00:22 - 2013-04-19 21:53 - 00295558 ____N C:\WINDOWS\Minidump\061415-8296-01.dmp
2015-06-11 21:57 - 2014-01-08 12:12 - 00020874 _____ C:\WINDOWS\system32\Drivers\fvstore.dat
2015-06-11 21:57 - 2013-04-19 21:53 - 00296240 ____N C:\WINDOWS\Minidump\061115-8640-01.dmp

==================== Files in the root of some directories =======

2015-03-22 20:39 - 2015-03-22 20:39 - 0002133 _____ () C:\Users\konvicto\AppData\Local\recently-used.xbel
2013-04-22 23:10 - 2013-04-22 23:10 - 0009650 _____ () C:\Users\konvicto\AppData\Local\WiDiSetupLog.20130422.231036.txt
2013-05-01 19:12 - 2013-05-01 19:12 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-04-22 22:44 - 2013-04-22 22:44 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\konvicto\AppData\Local\Temp\avgnt.exe
C:\Users\konvicto\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\konvicto\AppData\Local\Temp\Quarantine.exe
C:\Users\konvicto\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-09 22:01

==================== End of log ============================

vanmoretti 11.07.2015 12:31
Addition wieder zu lang. Deshalb .txt

M-K-D-B 11.07.2015 15:46
Servus,


kannst du mal bitte alle Programme deinstallieren, die du seit Beginn des Problems hast?


Dann noch ESET bitte:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


vanmoretti 12.07.2015 15:50
Eset kann leider auch nicht vollständig durchgeführt werden,
da es auch hier im Scandurchlauf immer wieder zum Absturz kommt,
nach einer gewissen Zeit

vanmoretti 12.07.2015 17:53
Liste der Anhänge anzeigen (Anzahl: 1)
Der letzte Durchlauf von ESET hat fast 43% bei 1:26 geschafft bevor der Absturz kam.

Ein Screenshot den ich kurz davor aufgenommen habe.


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:44 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131