| |
| |||||||
Log-Analyse und Auswertung: Trotz ESET NOD32 infizierte Dateien gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.08.2012, 22:03
| #1 |
 |  Trotz ESET NOD32 infizierte Dateien gefunden Hallo Team vom Trojaner-Board, heute bin ich bei der Kontrolle meines Virenscanners ESET NOD32 Antivirus über log Einträge gestolpert (siehe ESETNOD32_log.txt). Daraufhin führte ich einen Quick-Scan mit Malwarebytes durch und erhielt prompt Funde die ich aber erfolgreich löschen konnte und es wurde ein neuer Eintrag in der logDatei des Virenscanners erzeugt. Zur Sicherheit führte ich dann noch einen Voll-Scan durch und es wurde wieder etwas gefunden. Die beiden log-Dateien habe ich beigefügt. Nun bin ich etwas verunsichert ob mein System jetzt wieder sauber ist oder ob ich zur Sicherheit noch andere Maßnahmen ergreifen sollte. Könntet Ihr bitte mal die Logdateien prüfen und mir vielleicht weitere Empfehlungen geben. Vielen Dank schon mal im Voraus! Nachfolgend die OTL.txt, aber den Rest der log-Dateien habe ich als zip-Datei angehangen. Code:
ATTFilter OTL logfile created on: 10.08.2012 21:42:29 - Run 1 OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\***\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 2,38 Gb Available Physical Memory | 67,91% Memory free 6,99 Gb Paging File | 5,83 Gb Available in Paging File | 83,41% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 74,53 Gb Total Space | 10,68 Gb Free Space | 14,33% Space Free | Partition Type: NTFS Drive F: | 232,88 Gb Total Space | 178,55 Gb Free Space | 76,67% Space Free | Partition Type: NTFS Drive M: | 931,51 Gb Total Space | 869,44 Gb Free Space | 93,34% Space Free | Partition Type: NTFS Computer Name: PC-*** | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.10 21:38:04 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe PRC - [2012.05.20 19:23:43 | 000,021,416 | ---- | M] () -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe PRC - [2012.04.27 02:13:06 | 003,521,424 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe PRC - [2012.03.26 09:00:48 | 000,640,440 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe PRC - [2012.03.07 15:40:34 | 000,913,144 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe PRC - [2012.03.07 15:40:28 | 003,117,344 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe PRC - [2012.01.23 06:43:08 | 000,092,592 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.01.19 08:10:48 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files\CyberLink\Shared files\brs.exe PRC - [2009.07.06 15:22:04 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe PRC - [2009.06.26 16:56:58 | 000,102,400 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe PRC - [2009.06.26 16:56:20 | 000,450,560 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe ========== Modules (No Company Name) ========== MOD - [2012.06.14 09:27:26 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll MOD - [2012.06.14 09:23:57 | 018,000,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll MOD - [2012.06.14 09:23:33 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll MOD - [2012.06.14 09:23:15 | 003,858,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll MOD - [2012.06.14 09:23:12 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll MOD - [2012.05.20 19:23:49 | 000,115,137 | ---- | M] () -- C:\Users\***\AppData\Local\Temp\c25e8b3d-33a7-42bf-85e6-6880c6753136\CliSecureRT.dll MOD - [2012.05.20 19:23:43 | 000,021,416 | ---- | M] () -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe MOD - [2012.05.11 17:41:26 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll MOD - [2012.05.10 21:08:59 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll MOD - [2012.05.10 21:08:47 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll MOD - [2012.05.10 17:28:40 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll MOD - [2012.05.10 17:25:22 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll MOD - [2012.05.10 17:25:11 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll MOD - [2012.05.10 17:24:59 | 009,091,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll MOD - [2012.05.10 17:24:49 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll MOD - [2009.02.27 17:39:29 | 000,019,968 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.DEU MOD - [2009.02.27 17:32:27 | 000,020,480 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA ========== Win32 Services (SafeList) ========== SRV - [2012.03.07 15:40:34 | 000,913,144 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2012.02.10 20:44:06 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2012.01.23 06:43:08 | 000,092,592 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService) SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.06.26 16:56:58 | 000,102,400 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe -- (WDBtnMgrSvc.exe) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc) DRV - [2012.08.10 20:26:21 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\qghikr.sys -- (qktq) DRV - [2012.03.14 08:40:02 | 000,169,080 | ---- | M] (ESET) [File_System | System | Running] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm) DRV - [2012.03.14 08:40:02 | 000,120,152 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv) DRV - [2012.03.14 08:40:02 | 000,103,112 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr) DRV - [2011.09.07 11:18:26 | 000,059,776 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SCR3XX2K.sys -- (SCR3XX2K) DRV - [2011.06.02 07:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm) DRV - [2011.06.02 07:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) DRV - [2011.06.02 07:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.01.19 17:10:38 | 000,087,536 | ---- | M] (CyberLink Corp.) [2012/01/29 19:40:37] [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD}) DRV - [2009.09.28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7) DRV - [2009.07.14 00:09:17 | 004,194,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2008.05.16 17:54:58 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM) DRV - [2007.10.03 23:55:36 | 000,019,240 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiWinAcc.sys -- (SiFilter) DRV - [2007.10.03 23:55:28 | 000,015,400 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiRemFil.sys -- (SiRemFil) DRV - [2007.10.03 23:55:08 | 000,080,424 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SI3132.sys -- (SI3132) DRV - [2004.08.13 10:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 12 55 CD 52 0D DE CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {81B74392-C157-42AD-A4CC-10DC837C007A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{81B74392-C157-42AD-A4CC-10DC837C007A}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKCU\..\SearchScopes\{EA66E912-4085-431F-8625-EB23CAC25091}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: MapShare-status@tomtom.com:1.7.1 FF - prefs.js..extensions.enabledItems: baseTheme@tomtom.com:1.0.2 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.06.10 12:02:35 | 000,000,000 | ---D | M] [2012.02.22 20:23:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions [2012.02.22 20:23:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2012.02.22 20:23:41 | 000,000,000 | ---D | M] (Map status indicator) -- C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\MAPSHARE-STATUS@TOMTOM.COM O1 HOSTS File: ([2012.02.10 20:40:38 | 000,000,852 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.) O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [BDRegion] C:\Program Files\CyberLink\Shared files\brs.exe (cyberlink) O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [RemoteControl9] C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe (WDC) O4 - HKCU..\Run: [AdobeBridge] File not found O4 - HKCU..\Run: [KiesAirMessage] C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup File not found O4 - HKCU..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKCU..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3020F6FA-0D2C-4B54-8F03-A182FEF32B2F}: DhcpNameServer = 192.168.2.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.08.10 21:38:00 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2012.08.10 21:33:51 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Trojaner_log [2012.08.10 18:12:50 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\ESET [2012.08.10 18:08:33 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes [2012.08.10 18:08:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.10 18:08:08 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.08.10 18:08:08 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.08.10 18:08:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.10 18:04:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9F43C30D-FA83-4110-AC9E-17E421987E86} [2012.08.10 18:04:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{0E46DB95-24FB-4F8F-BC3A-585DFD8A7FC8} [2012.08.09 21:51:33 | 000,000,000 | ---D | C] -- C:\acr_logs [2012.08.09 19:42:22 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E06F8171-1CCD-4AD1-96E7-9D776DC81251} [2012.08.09 19:42:10 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{372C265A-754E-45F6-950A-223ECC1E31A2} [2012.08.09 19:41:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{D14085F1-2A33-4D7E-B0A2-EA7031A1CC9D} [2012.08.09 06:22:42 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5FC88F26-86DE-410F-BA2F-A1014FEDF214} [2012.08.09 06:22:30 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E1E012F0-C77A-471A-99EC-05F1D8CA25EA} [2012.08.07 20:36:21 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A72A2518-5E2D-4000-9DF0-196C1AE9DA6D} [2012.08.07 20:36:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7DCBAE29-35A2-407B-96AB-AB8BAF97EC58} [2012.08.06 17:43:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E0F2956C-E771-4511-A8AC-D263742DA5E8} [2012.08.06 17:43:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{E3DB9F6D-7F44-4D5D-AD52-0BDA505701A0} [2012.08.05 17:53:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{213DA631-C9E5-49EB-AA8E-1D7174CC576A} [2012.08.05 17:53:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{46DCB9C8-11BB-4E6E-AEA3-E4F2EAF06B2F} [2012.08.03 19:05:02 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{2CA8A7C6-9E8B-444E-93F9-DB7D6FCBAA84} [2012.08.03 19:04:49 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6C810D69-5FA7-4D16-9733-1BBADB24E9DE} [2012.08.02 17:45:59 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{CBEFCB76-25DF-4391-9E2D-2F0D107EAD42} [2012.08.02 17:45:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{AAB0768D-091B-47D8-9AA9-5794E3F065CB} [2012.07.31 08:35:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{22AC9CDF-DFA8-4C2C-A84A-A4A6C0701B3A} [2012.07.31 08:35:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A22E530E-213F-4F74-8FC8-4FFD2DF9BC7A} [2012.07.30 12:51:21 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{D547F52A-E06E-4177-B317-5E7CFE94D4C1} [2012.07.30 12:51:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{4520A7C4-F7EE-4709-980C-ED07A4DFFB42} [2012.07.26 15:26:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{F4516D38-FEFD-4F72-B51D-9E9369906A11} [2012.07.26 15:26:20 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{1EEC3F40-1106-48AB-9BA6-598915A7140A} [2012.07.25 19:25:40 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{880DC10B-7251-4D6E-B420-46B400DBB60E} [2012.07.25 19:25:28 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7D4190A9-C279-4F91-AECB-A69991B237ED} [2012.07.24 17:40:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B2527949-71EA-481A-BC7D-C97A3A576C7F} [2012.07.24 17:40:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{69CEC090-7AE4-4880-8682-A7A3C512CF7C} [2012.07.23 18:10:56 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{BBD4E925-533D-4104-A808-48443CC7C9AA} [2012.07.23 18:10:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{0902C8C2-182F-41E9-B1B2-67C1C98A3A39} [2012.07.22 08:33:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B20E3487-F079-4941-9837-D17C020A77DF} [2012.07.22 08:33:34 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{94575B9F-7CC4-4FBC-B625-576E3C017279} [2012.07.21 12:40:17 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9C880F70-DD43-428C-8E31-7A3EDA85E1A9} [2012.07.21 12:40:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{AAC509F5-C31D-4A2C-B54F-11E61C3D8C06} [2012.07.21 08:48:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{37B0D9D4-8D78-45A1-9EA6-85873CA34E72} [2012.07.20 09:34:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{18BEE1C4-C192-4EF6-9B60-1A711424835A} [2012.07.20 09:34:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{8A60B6E2-8D2F-46F0-937F-D459551FFEF9} [2012.07.19 11:10:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{4991AB94-FFFC-4D4C-AA90-69F5F77E9E95} [2012.07.19 11:10:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{A7DB22F6-7201-4D91-9D0F-5DE516F6828B} [2012.07.18 15:34:18 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7A6A3BB5-E9CD-44F7-BCF0-E7801A4B2C3C} [2012.07.18 15:34:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{9901D87F-AA33-42B0-A7BD-BF2C4022B899} [2012.07.18 15:22:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{99A7A418-ECE7-43C1-BD93-72C609E77097} [2012.07.18 15:22:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{12746EFA-4E1E-4978-B21C-06BDCC9F0277} [2012.07.17 20:21:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{F1DAB9DA-3FE5-401A-9E9A-01DAD7D35405} [2012.07.17 20:21:34 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{3E2DD971-A11F-43A4-84FC-4CEA3B6F6EB4} [2012.07.16 16:57:57 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{ED0D8575-FA4E-438A-B3F8-5BCF6105A722} [2012.07.16 16:57:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{49E6F36D-E8A9-450F-977C-25929497A0E8} [2012.07.15 16:56:16 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{83FABD44-4063-4CD2-AE08-69336A99E69B} [2012.07.15 16:56:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{EF48650B-D2F9-4580-A61F-6608308530B8} [2012.07.14 14:15:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLoad [2012.07.14 14:15:33 | 000,000,000 | ---D | C] -- C:\Program Files\iLoad [2012.07.14 10:34:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{CF89B2D7-587B-40FC-BFC5-5C87F87A17CF} [2012.07.14 10:33:57 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{6CFBFADF-6828-4FD4-8E76-28B70D914A67} [2012.07.13 11:30:24 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{818AA33D-F8DD-4D1F-A467-465B72B934E2} [2012.07.13 11:30:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{5412FF56-7A64-4F57-92EC-2D93CA58F6C5} [2012.07.12 17:53:23 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{4D9ACE3D-91F9-4ACD-9270-8635B5519A5F} [2012.07.12 17:53:11 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{D4D07337-66B2-4D46-9578-AE6F014FDF47} [2012.02.09 21:15:40 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\***\AppData\Roaming\pcouffin.sys ========== Files - Modified Within 30 Days ========== [2012.08.10 21:38:04 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2012.08.10 21:37:14 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable [2012.08.10 20:26:21 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\qghikr.sys [2012.08.10 20:26:21 | 000,000,420 | ---- | M] () -- C:\Windows\System32\ufuhnlr [2012.08.10 18:32:04 | 000,017,136 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.10 18:32:04 | 000,017,136 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.10 18:24:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.10 18:24:28 | 2817,871,872 | -HS- | M] () -- C:\hiberfil.sys [2012.08.03 20:19:03 | 010,420,290 | ---- | M] () -- C:\Users\***\Documents\Yamaha_XTZ_660_1991_Service_Manual.pdf [2012.07.14 14:15:34 | 000,000,847 | ---- | M] () -- C:\Users\Public\Desktop\iLoad.lnk [2012.07.12 17:51:29 | 003,799,432 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2012.08.10 21:37:14 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable [2012.08.10 20:26:21 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\qghikr.sys [2012.08.10 20:26:21 | 000,000,420 | ---- | C] () -- C:\Windows\System32\ufuhnlr [2012.08.03 20:19:01 | 010,420,290 | ---- | C] () -- C:\Users\***\Documents\Yamaha_XTZ_660_1991_Service_Manual.pdf [2012.05.10 16:16:25 | 000,003,584 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.02.09 21:15:40 | 000,087,608 | ---- | C] () -- C:\Users\***\AppData\Roaming\inst.exe [2012.02.09 21:15:40 | 000,007,887 | ---- | C] () -- C:\Users\***\AppData\Roaming\pcouffin.cat [2012.02.09 21:15:40 | 000,001,144 | ---- | C] () -- C:\Users\***\AppData\Roaming\pcouffin.inf [2012.01.31 22:19:57 | 000,000,000 | ---- | C] () -- C:\Windows\homeDVD-Fotos5_5.INI [2012.01.31 21:20:16 | 000,003,237 | ---- | C] () -- C:\Windows\mgxoschk.ini [2012.01.30 16:47:54 | 000,000,162 | ---- | C] () -- C:\Windows\ODBC.INI [2012.01.30 15:16:47 | 000,000,017 | ---- | C] () -- C:\Users\***\AppData\Local\resmon.resmoncfg [2012.01.29 23:52:52 | 000,000,377 | ---- | C] () -- C:\Windows\OPLS.INI [2012.01.29 18:25:39 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2012.01.29 10:37:03 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2012.01.29 10:34:22 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2012.01.29 00:21:13 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.01.29 00:21:13 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2011.03.02 07:57:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.03.02 07:57:40 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2011.03.02 07:57:40 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2011.03.02 07:57:40 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2011.03.02 07:57:40 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll ========== LOP Check ========== [2012.05.10 16:25:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon [2012.08.10 18:23:03 | 000,000,000 | RHSD | M] -- C:\Users\***\AppData\Roaming\drivers [2012.01.31 20:03:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Haenlein-Software [2012.01.29 23:46:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Paloma Networks, Inc [2012.05.20 19:22:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Samsung [2012.01.30 15:41:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online [2012.02.22 20:23:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TomTom [2012.01.31 20:24:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Tyre [2012.02.15 07:39:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Vso [2012.01.29 19:58:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Western Digital [2012.01.30 15:08:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer [2012.07.14 10:19:55 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > |
| Themen zu Trotz ESET NOD32 infizierte Dateien gefunden |
| 2 infizierte dateien, adobe, antivirus, bho, defender, download, eset nod32, explorer, firefox, format, helper, home, hängen, infizierte, infizierte dateien, langs, log, logfile, löschen, object, plug-in, prüfen, registry, scan, sicherheit, software, suche, system, temp, trojaner-board, windows, zip-datei |
Baum-Darstellung