| |
| |||||||
Log-Analyse und Auswertung: Malwarebytes findet ctfmon.lnk im Startup-OrdnerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.08.2012, 18:53
| #9 |
| |  Malwarebytes findet ctfmon.lnk im Startup-Ordner Hallo, hier die Ergebnisse der Scans. AdwCleaner Code:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/08/2012 at 17:47:33
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Andreas - LAPTOP
# Running from : C:\Users\Andreas\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Users\Andreas\AppData\Local\Conduit
Folder Deleted : C:\Users\Brigitte\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Jana\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Andreas\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Andreas\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Andreas\AppData\LocalLow\uTorrentBar_DE
Folder Deleted : C:\Users\Administrator\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Andreas\AppData\Roaming\Media Finder
Folder Deleted : C:\Users\Andreas\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
Folder Deleted : C:\Users\Brigitte\AppData\Roaming\Mozilla\Firefox\Profiles\vwiu0t4k.default\extensions\staged
Folder Deleted : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\htsyhxg3.default\ConduitCommon
Folder Deleted : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\htsyhxg3.default\CT2851647
Folder Deleted : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\htsyhxg3.default\extensions\{c840e246-6b95-475e-9bd7-caa1c7eca9f2}
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\uTorrentBar_DE
***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2851647
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Ask.com.tmp
Key Deleted : HKCU\Software\MediaFinder
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
Key Deleted : HKLM\SOFTWARE\Classes\MF
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentBar_DE Toolbar
Key Deleted : HKLM\SOFTWARE\Software
Key Deleted : HKLM\SOFTWARE\uTorrentBar_DE
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2E61BEA4-D5C3-443E-92B7-672B0E36D5FE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{67949584-D2DB-452C-8B0C-DB1C7F5B381B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E57273A-4BA4-4758-B225-0199CEB20383}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2E61BEA4-D5C3-443E-92B7-672B0E36D5FE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2E61BEA4-D5C3-443E-92B7-672B0E36D5FE}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Brigitte\AppData\Roaming\Mozilla\Firefox\Profiles\vwiu0t4k.default\prefs.js
Deleted : user_pref("extensions.smarterwiki.search_surfcanyon", false);
Profile name : default
File : C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\99zdufqb.default\prefs.js
[OK] File is clean.
Profile name : default
File : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\htsyhxg3.default\prefs.js
Deleted : user_pref("CT2851647..clientLogIsEnabled", false);
Deleted : user_pref("CT2851647..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2851647..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2851647.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2851647.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2851647.AppTrackingLastCheckTime", "Thu Jul 19 2012 09:15:28 GMT+0200");
Deleted : user_pref("CT2851647.CTID", "CT2851647");
Deleted : user_pref("CT2851647.CurrentServerDate", "8-8-2012");
Deleted : user_pref("CT2851647.DSInstall", false);
Deleted : user_pref("CT2851647.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2851647.DialogsGetterLastCheckTime", "Sun Aug 05 2012 20:55:21 GMT+0200");
Deleted : user_pref("CT2851647.DownloadReferralCookieData", "");
Deleted : user_pref("CT2851647.EMailNotifierPollDate", "Wed Aug 08 2012 17:45:24 GMT+0200");
Deleted : user_pref("CT2851647.FeedLastCount2532783744689806690", 501);
Deleted : user_pref("CT2851647.FeedPollDate2429156812186649977", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156813040823546", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156813130095866", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156813224203613", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156813230837251", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156813454291735", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156813729834876", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156813860870021", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156814264681793", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156814863075366", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedPollDate2429156815257761081", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.FeedTTL2429156813040823546", 15);
Deleted : user_pref("CT2851647.FeedTTL2429156813130095866", 10);
Deleted : user_pref("CT2851647.FeedTTL2429156813454291735", 5);
Deleted : user_pref("CT2851647.FeedTTL2429156814264681793", 5);
Deleted : user_pref("CT2851647.FirstServerDate", "12-6-2012");
Deleted : user_pref("CT2851647.FirstTime", true);
Deleted : user_pref("CT2851647.FirstTimeFF3", true);
Deleted : user_pref("CT2851647.FirstTimeHiddenVer", true);
Deleted : user_pref("CT2851647.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2851647.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2851647.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2851647.HPInstall", false);
Deleted : user_pref("CT2851647.HasUserGlobalKeys", true);
Deleted : user_pref("CT2851647.HomePageProtectorEnabled", false);
Deleted : user_pref("CT2851647.HomepageBeforeUnload", "hxxp://go.web.de/tb/mff_startpage_home");
Deleted : user_pref("CT2851647.Initialize", true);
Deleted : user_pref("CT2851647.InitializeCommonPrefs", true);
Deleted : user_pref("CT2851647.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2851647.InstallationId", "fft5939.tmp.exe");
Deleted : user_pref("CT2851647.InstallationType", "XPE");
Deleted : user_pref("CT2851647.InstalledDate", "Tue Jun 12 2012 19:10:03 GMT+0200");
Deleted : user_pref("CT2851647.IsAlertDBUpdated", true);
Deleted : user_pref("CT2851647.IsGrouping", false);
Deleted : user_pref("CT2851647.IsInitSetupIni", true);
Deleted : user_pref("CT2851647.IsMulticommunity", false);
Deleted : user_pref("CT2851647.IsOpenThankYouPage", true);
Deleted : user_pref("CT2851647.IsOpenUninstallPage", false);
Deleted : user_pref("CT2851647.LanguagePackLastCheckTime", "Wed Aug 08 2012 17:35:24 GMT+0200");
Deleted : user_pref("CT2851647.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2851647.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2851647.LastLogin_3.13.0.6", "Thu Jul 19 2012 09:15:20 GMT+0200");
Deleted : user_pref("CT2851647.LastLogin_3.14.1.0", "Wed Aug 08 2012 17:35:24 GMT+0200");
Deleted : user_pref("CT2851647.LatestVersion", "3.14.1.0");
Deleted : user_pref("CT2851647.Locale", "de");
Deleted : user_pref("CT2851647.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2851647.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2851647.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2851647.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2851647.OriginalFirstVersion", "3.13.0.6");
Deleted : user_pref("CT2851647.SearchCaption", "uTorrentBar_DE Customized Web Search");
Deleted : user_pref("CT2851647.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Deleted : user_pref("CT2851647.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2851647.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT285[...]
Deleted : user_pref("CT2851647.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2851647.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2851647.SearchInNewTabLastCheckTime", "Wed Aug 08 2012 17:35:23 GMT+0200");
Deleted : user_pref("CT2851647.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2851647.SearchProtectorEnabled", false);
Deleted : user_pref("CT2851647.SearchProtectorToolbarDisabled", false);
Deleted : user_pref("CT2851647.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT2851647.ServiceMapLastCheckTime", "Wed Aug 08 2012 17:35:23 GMT+0200");
Deleted : user_pref("CT2851647.SettingsLastCheckTime", "Wed Aug 08 2012 17:35:21 GMT+0200");
Deleted : user_pref("CT2851647.SettingsLastUpdate", "1342353909");
Deleted : user_pref("CT2851647.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2851647&SearchSource=13");
Deleted : user_pref("CT2851647.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2851647.ThirdPartyComponentsLastCheck", "Thu Jul 26 2012 20:07:05 GMT+0200");
Deleted : user_pref("CT2851647.ThirdPartyComponentsLastUpdate", "1331806000");
Deleted : user_pref("CT2851647.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2851647.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2851647");
Deleted : user_pref("CT2851647.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2851647.UserID", "UN85873740707211467");
Deleted : user_pref("CT2851647.ValidationData_Toolbar", 1);
Deleted : user_pref("CT2851647.WeatherNetwork", "");
Deleted : user_pref("CT2851647.WeatherPollDate", "Wed Aug 08 2012 17:35:25 GMT+0200");
Deleted : user_pref("CT2851647.WeatherUnit", "C");
Deleted : user_pref("CT2851647.alertChannelId", "1243681");
Deleted : user_pref("CT2851647.autoDisableScopes", -1);
Deleted : user_pref("CT2851647.backendstorage.cb_experience_000", "35");
Deleted : user_pref("CT2851647.backendstorage.cb_firstuse0100", "31");
Deleted : user_pref("CT2851647.backendstorage.cb_user_id_000", "43423138353834313733313537335F46697265666F78")[...]
Deleted : user_pref("CT2851647.backendstorage.cbcountry_000", "4445");
Deleted : user_pref("CT2851647.backendstorage.cbcountry_001", "4445");
Deleted : user_pref("CT2851647.backendstorage.cbfirsttime", "547565204A756E20313220323031322031393A31303A31312[...]
Deleted : user_pref("CT2851647.backendstorage.scriptsource", "687474703A2F2F3132372E302E302E313A31303030302F67[...]
Deleted : user_pref("CT2851647.backendstorage.url_history0001", "687474703A2F2F7777772E74726F6A616E65722D626F6[...]
Deleted : user_pref("CT2851647.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2851647.globalFirstTimeInfoLastCheckTime", "Mon Aug 06 2012 17:39:01 GMT+0200");
Deleted : user_pref("CT2851647.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2851647.initDone", true);
Deleted : user_pref("CT2851647.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2851647.myStuffEnabled", true);
Deleted : user_pref("CT2851647.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2851647.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2851647.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2851647.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2851647.navigateToUrlOnSearch", false);
Deleted : user_pref("CT2851647.oldAppsList", "129351532244963279,129351532245275780,1000234,129791456886122866[...]
Deleted : user_pref("CT2851647.revertSettingsEnabled", true);
Deleted : user_pref("CT2851647.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2851647.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2851647.testingCtid", "");
Deleted : user_pref("CT2851647.toolbarAppMetaDataLastCheckTime", "Wed Aug 08 2012 17:35:24 GMT+0200");
Deleted : user_pref("CT2851647.toolbarContextMenuLastCheckTime", "Mon Jul 30 2012 17:39:21 GMT+0200");
Deleted : user_pref("CT2851647.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2851647/CT2851647[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2851647", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2851647",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"ecc[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Andreas\\AppData\\Roaming\\Mozilla\[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.14.1.0");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2851647");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2851647");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2851647");
Deleted : user_pref("CommunityToolbar.globalUserId", "40556531-ed25-416a-b3d3-6187ad4deda4");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2851647");
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Tue Aug 07 2012 17:34:1[...]
Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", false);
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Aug 08 2012 17:35:27 GMT+0200");
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "fc916a99-b53b-4968-bfb1-b2b2407e0998");
Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://go.web.de/tb/mff_startpage_home");
Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=2&q=[...]
Profile name : default
File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\ib2txj42.default\prefs.js
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [17899 octets] - [06/08/2012 19:33:19]
AdwCleaner[S1].txt - [17557 octets] - [08/08/2012 17:47:33]
########## EOF - C:\AdwCleaner[S1].txt - [17686 octets] ##########
Und der Bericht von Emsisoft Code:
ATTFilter Emsisoft Anti-Malware - Version 6.6
Letztes Update: 08.08.2012 17:58:30
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An
Scan Beginn: 08.08.2012 18:04:08
C:\Users\Jana\Saved Games\Polar Bowler\Polar.Bowler.v1.0-NiTROUS\crack.zip -> Polar.exe gefunden: Email-Worm.Win32.Brontok!E2
C:\Users\Jana\Saved Games\Polar Bowler\Polar.Bowler.v1.0-NiTROUS\Polar.exe gefunden: Email-Worm.Win32.Brontok!E2
C:\Users\Jana\Downloads\Polar.Bowler.v1.0-NiTROUS.ZIP -> Polar.Bowler.v1.0-NiTROUS\crack.zip gefunden: Email-Worm.Win32.Brontok!E2
C:\Users\Jana\Downloads\Polar.Bowler.v1.0-NiTROUS.ZIP -> Polar.Bowler.v1.0-NiTROUS\crack.zip -> Polar.exe gefunden: Email-Worm.Win32.Brontok!E2
C:\Users\Andreas\Downloads\Windows+7+Loader+v2.1.1+by+Daz+(x86+&+x64).zip -> Windows Loader\Windows Loader.exe gefunden: HackTool.Win32.Gendows!E2
C:\Users\Andreas\Downloads\Windows Loader\Windows Loader.exe gefunden: HackTool.Win32.Gendows.AMN!E1
C:\Users\Andreas\Desktop\Download\ Polar Bowler.rar -> Polar Bowler\Polar.exe gefunden: Email-Worm.Win32.Brontok!E2
C:\source\Easytools\easyusetool_frontend_0514_gsmfree.exe gefunden: Backdoor.Win32.Hupigon!E2
C:\$Recycle.Bin\S-1-5-21-3292852919-811151621-2006029298-1004\$R67DO79.exe gefunden: Email-Worm.Win32.Brontok!E2
Gescannt 602907
Gefunden 9
Scan Ende: 08.08.2012 19:41:52
Scan Zeit: 1:37:44
C:\source\Easytools\easyusetool_frontend_0514_gsmfree.exe Quarantäne Backdoor.Win32.Hupigon!E2
C:\Users\Andreas\Downloads\Windows Loader\Windows Loader.exe Quarantäne HackTool.Win32.Gendows.AMN!E1
C:\Users\Andreas\Downloads\Windows+7+Loader+v2.1.1+by+Daz+(x86+&+x64).zip -> Windows Loader\Windows Loader.exe Quarantäne HackTool.Win32.Gendows!E2
C:\Users\Jana\Saved Games\Polar Bowler\Polar.Bowler.v1.0-NiTROUS\crack.zip -> Polar.exe Quarantäne Email-Worm.Win32.Brontok!E2
C:\Users\Jana\Saved Games\Polar Bowler\Polar.Bowler.v1.0-NiTROUS\Polar.exe Quarantäne Email-Worm.Win32.Brontok!E2
C:\Users\Jana\Downloads\Polar.Bowler.v1.0-NiTROUS.ZIP -> Polar.Bowler.v1.0-NiTROUS\crack.zip Quarantäne Email-Worm.Win32.Brontok!E2
C:\Users\Andreas\Desktop\Download\ Polar Bowler.rar -> Polar Bowler\Polar.exe Quarantäne Email-Worm.Win32.Brontok!E2
C:\$Recycle.Bin\S-1-5-21-3292852919-811151621-2006029298-1004\$R67DO79.exe Quarantäne Email-Worm.Win32.Brontok!E2
Quarantäne 8
|
| Themen zu Malwarebytes findet ctfmon.lnk im Startup-Ordner |
| bundes, bundestrojaner, ctfmon.lnk, datei, defogger, deo0_sar.exe, eliminieren, entfern, entfernt, ergebnisse, erschein, erscheint, fehlermeldung, gefunde, heute, infiziert., konnte, link, malwarebytes, mehreren, otl.exe, rechner, schritte, stunde, stunden, suche, trojan.ransom.gen, trojaners |
Baum-Darstellung