|
Log-Analyse und Auswertung: PWS:Win32/Zbot.gen!Y Meldung, nach Windows UpdateWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
14.06.2013, 18:16 | #1 |
| PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Hallo liebe Forumsmitglieder, nachdem ich heute einige Updates von Windows gezogen hatte und meinen Rechner neugestartet habe, hat mir Microsoft Safety Scanner den Fund des Trojaners PWS:Win32/Zbot.gen!Y gemeldet. In einem Thread vom User "carolus", der das gleiche Problem hatte, habe ich schon einmal vorab einige Programme durchlaufen lassen. 1.Defogger (hat keine Probleme gemacht) 2.Gmer 3.OTL Da die Dateien zu lange sind habe ich diese unten angehangen. Ich bedanke mich schon einmal im Voraus für alle eure Bemühungen mir bei meinem Problem zu helfen. Ralf |
14.06.2013, 18:16 | #2 |
/// the machine /// TB-Ausbilder | PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Hi,
__________________Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
14.06.2013, 18:30 | #3 |
| PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Danke für die schnelle Antwort und hier die Log-Fileauswertungen
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-06-2013 Ran by RalfManuela (administrator) on 14-06-2013 19:23:52 Running from C:\Users\RalfManuela\Downloads\Maleware Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Logitech Inc.) C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Logitech Inc.) C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe () C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation) C:\Windows\splwow64.exe ==================== Registry (Whitelisted) ================== HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation) HKCU\...\Run: [Google Update] "C:\Users\RalfManuela\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-11-25] (Google Inc.) MountPoints2: F - F:\AutoRun.exe MountPoints2: H - H:\AutoRun.exe MountPoints2: {07aebfa7-66b5-11e1-8b7d-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {116e20f6-5960-11e1-bbf7-88ae1da3f0f3} - F:\AutoRun.exe MountPoints2: {116e2114-5960-11e1-bbf7-88ae1da3f0f3} - F:\AutoRun.exe MountPoints2: {2b3d24d3-7365-11e1-86e6-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {68092108-6765-11e1-90e8-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {7c21132c-9289-11e0-8508-88ae1da3f0f3} - E:\Setup.exe MountPoints2: {c93614e2-8a21-11e1-a7df-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {d2cb3ce9-87d5-11e1-b1ef-4c0f6e89b879} - H:\AutoRun.exe MountPoints2: {e88dce07-df72-11e0-a9e9-4c0f6e89b879} - F:\LaunchU3.exe -a HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [265984 2010-06-28] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [258512 2012-01-31] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-15] () HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-15] () Startup: C:\ProgramData\Start Menu\Programs\Startup\ImageBrowser EX Agent.lnk ShortcutTarget: ImageBrowser EX Agent.lnk -> C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://gmx.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {B1953AD6-C50E-11D3-B020-00A0C9251384} hxxp://www.o2c.de/download/o2cplayer.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} DPF: HKLM-x32 {E4CF4E86-D0DC-4864-8F0E-4F6EA2526334} https://img.ui-portal.de/webde/smartdrive/activex/gmxnet_osupload_2002.cab Tcpip\..\Interfaces\{49F83F9E-C33B-4DCC-9FDE-8A0599FFF673}: [NameServer]192.168.1.1 Tcpip\..\Interfaces\{4B3812D0-B847-4C00-B369-9A7A58ADAD30}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{67BBAC55-A6B2-40A7-B2D7-5728B8251FE7}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{6B6261FB-FF7D-4EDC-9DD4-CEB02432427F}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{95AC8154-8DCA-429B-9236-B3FB9717E7D4}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{D6BE1B99-CFD7-477B-9CFF-AA71AD37B55F}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{E9E93C80-E306-43FC-BF7F-C66C88999966}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{FBE8EDFF-40B4-4F01-B66D-8CE039DB5E4E}: [NameServer]192.168.1.1 Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR RestoreOnStartup: "hxxp://www.google.com/" CHR Extension: (YouTube) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0 CHR Extension: (Google Search) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0 CHR Extension: (RealDownloader) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.0_0 CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0 CHR Extension: (Gmail) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-01-31] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-01-31] (Avira Operations GmbH & Co. KG) R2 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97312 2012-01-31] (Avira GmbH) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132320 2012-01-31] (Avira GmbH) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-16] (Avira GmbH) S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [246224 2009-12-07] (Huawei Technologies Co., Ltd.) S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.) R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] () S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] () S3 SMIGrabber3C; C:\Windows\System32\Drivers\SmiUsbGrabber3C.sys [811520 2009-05-14] (Windows (R) Win 7 DDK provider) R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] () S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [x] U4 mbamswissarmy; ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-06-14 19:23 - 2013-06-14 19:23 - 00000000 ____D C:\FRST 2013-06-14 19:20 - 2013-06-14 19:23 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-06-14 19:17 - 2013-06-14 19:17 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-06-14 17:54 - 2013-06-14 17:54 - 00035328 ____H C:\Users\RalfManuela\Documents\~WRL0005.tmp 2013-06-14 13:48 - 2013-06-14 13:48 - 00000000 ____A C:\Users\RalfManuela\defogger_reenable 2013-06-14 11:54 - 2012-07-26 06:55 - 00785512 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys 2013-06-14 11:54 - 2012-07-26 06:55 - 00054376 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WdfLdr.sys 2013-06-14 11:54 - 2012-07-26 04:36 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\Wdfres.dll 2013-06-14 11:54 - 2012-06-02 16:35 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf 2013-06-14 11:53 - 2013-05-17 06:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-06-14 11:53 - 2013-05-17 05:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-06-14 11:53 - 2013-05-17 05:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-06-14 11:53 - 2013-05-17 05:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-06-14 11:53 - 2013-05-17 05:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-06-14 11:53 - 2013-05-17 05:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-06-14 11:53 - 2013-05-17 05:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2013-06-14 11:53 - 2013-05-17 04:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-06-14 11:53 - 2013-05-17 04:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-06-14 11:53 - 2013-05-17 04:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-06-14 11:53 - 2013-05-17 04:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-06-14 11:53 - 2013-05-17 04:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-06-14 11:53 - 2013-05-17 04:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-06-14 11:53 - 2013-05-17 04:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-06-14 11:53 - 2013-05-17 04:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-06-14 11:53 - 2013-05-17 04:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-06-14 11:53 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-06-14 11:53 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-06-14 11:53 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-06-14 11:53 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-06-14 11:53 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-06-14 11:53 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-06-14 11:53 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-06-14 11:53 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-06-14 11:53 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-06-14 11:53 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-06-14 11:53 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-06-14 11:53 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-06-14 11:53 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-06-14 11:53 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-06-14 11:53 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-06-14 11:53 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-06-14 11:50 - 2013-06-14 11:50 - 00000127 ____A C:\Windows\System32\MRT.INI 2013-06-14 11:46 - 2012-07-26 05:08 - 00744448 ____A (Microsoft Corporation) C:\Windows\System32\WUDFx.dll 2013-06-14 11:46 - 2012-07-26 05:08 - 00229888 ____A (Microsoft Corporation) C:\Windows\System32\WUDFHost.exe 2013-06-14 11:46 - 2012-07-26 05:08 - 00194048 ____A (Microsoft Corporation) C:\Windows\System32\WUDFPlatform.dll 2013-06-14 11:46 - 2012-07-26 05:08 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\WUDFSvc.dll 2013-06-14 11:46 - 2012-07-26 05:08 - 00045056 ____A (Microsoft Corporation) C:\Windows\System32\WUDFCoinstaller.dll 2013-06-14 11:46 - 2012-07-26 04:26 - 00198656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFRd.sys 2013-06-14 11:46 - 2012-07-26 04:26 - 00087040 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFPf.sys 2013-06-14 11:46 - 2012-06-02 16:57 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2013-06-14 11:40 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2013-06-14 11:40 - 2013-04-12 16:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys 2013-06-14 11:40 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2013-06-14 11:40 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys 2013-06-14 11:40 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll 2013-06-14 11:40 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll 2013-06-14 11:40 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2013-06-14 11:40 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll 2013-06-14 11:39 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe 2013-06-14 11:39 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll 2013-06-14 11:39 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll 2013-06-14 11:39 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll 2013-06-14 11:39 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2013-06-14 11:39 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2013-06-14 11:39 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-06-14 11:38 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-06-14 11:38 - 2013-02-12 06:12 - 00019968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys 2013-06-14 11:37 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll 2013-06-14 11:37 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll 2013-06-14 11:37 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll 2013-06-14 11:37 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll 2013-06-14 11:37 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-06-14 11:37 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-06-14 11:37 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-06-14 11:37 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe 2013-06-14 11:37 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe 2013-06-14 11:37 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll 2013-06-14 11:37 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll 2013-06-14 11:37 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll 2013-06-14 11:37 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll 2013-06-14 11:37 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2013-06-14 11:37 - 2013-01-24 08:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys 2013-06-03 12:45 - 2013-06-03 13:51 - 00000000 ____D C:\Users\RalfManuela\Documents\Mount&Blade Warband Savegames 2013-06-03 12:42 - 2013-06-03 12:51 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Mount&Blade Warband 2013-06-03 12:38 - 2013-06-03 12:38 - 00001102 ____A C:\Users\RalfManuela\Desktop\Mount&Blade Warband.lnk 2013-06-03 12:34 - 2013-06-03 12:43 - 00000000 ____D C:\Program Files (x86)\Mount&Blade Warband 2013-06-02 15:42 - 2013-06-02 15:42 - 00218129 ____A C:\Users\RalfManuela\Downloads\h2testw_1.4_Für Micro SD Karten.zip 2013-05-31 10:42 - 2013-05-31 10:42 - 00000000 ____D C:\Users\RalfManuela\cityguide 2013-05-30 20:06 - 2013-05-30 20:06 - 00003352 ____N C:\bootsqm.dat 2013-05-20 16:18 - 2013-05-20 16:18 - 00000000 ____D C:\Program Files (x86)\HamRadioSoftware 2013-05-17 15:50 - 2013-05-17 15:50 - 00001292 ____A C:\Users\Public\Desktop\Paint.NET.lnk 2013-05-17 15:49 - 2013-05-17 15:49 - 00000000 ____D C:\Program Files\Paint.NET 2013-05-17 15:48 - 2013-06-04 19:38 - 00000000 ____D C:\Users\RalfManuela\AppData\Local\Paint.NET 2013-05-16 20:53 - 2013-05-16 20:53 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Hunspell 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\Documents\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Program Files (x86)\CrossADe ==================== One Month Modified Files and Folders ======= 2013-06-14 19:23 - 2013-06-14 19:23 - 00000000 ____D C:\FRST 2013-06-14 19:23 - 2013-06-14 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-06-14 19:22 - 2013-03-21 23:00 - 00000000 ____D C:\Users\RalfManuela\Downloads\Maleware 2013-06-14 19:20 - 2012-11-25 10:04 - 00001144 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3326214151-3358978863-4268213387-1001UA.job 2013-06-14 19:17 - 2013-06-14 19:17 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-06-14 18:50 - 2010-09-21 16:38 - 01346104 ____A C:\Windows\WindowsUpdate.log 2013-06-14 18:47 - 2011-10-20 11:11 - 00000000 ____D C:\Users\RalfManuela\Documents\Ralf 2013-06-14 18:36 - 2011-05-12 18:31 - 00000000 ____D C:\ProgramData\boost_interprocess 2013-06-14 18:28 - 2012-03-30 21:32 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-06-14 18:04 - 2009-07-14 06:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-06-14 18:04 - 2009-07-14 06:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-06-14 17:56 - 2013-02-09 16:34 - 00016906 ____A C:\Windows\setupact.log 2013-06-14 17:56 - 2011-05-12 16:36 - 00000000 ____D C:\Windows\SysWOW64\logishrd 2013-06-14 17:56 - 2011-05-12 16:36 - 00000000 ____D C:\Windows\System32\logishrd 2013-06-14 17:56 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-06-14 17:54 - 2013-06-14 17:54 - 00035328 ____H C:\Users\RalfManuela\Documents\~WRL0005.tmp 2013-06-14 13:48 - 2013-06-14 13:48 - 00000000 ____A C:\Users\RalfManuela\defogger_reenable 2013-06-14 13:48 - 2011-05-12 16:02 - 00000000 ____D C:\users\RalfManuela 2013-06-14 13:39 - 2009-07-14 06:45 - 00348640 ____A C:\Windows\System32\FNTCACHE.DAT 2013-06-14 13:36 - 2011-05-15 03:18 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Gurewu 2013-06-14 11:57 - 2011-06-01 17:13 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-06-14 11:51 - 2010-09-22 02:28 - 00664868 ____A C:\Windows\System32\perfh007.dat 2013-06-14 11:51 - 2010-09-22 02:28 - 00135004 ____A C:\Windows\System32\perfc007.dat 2013-06-14 11:51 - 2009-07-14 07:13 - 01549542 ____A C:\Windows\System32\PerfStringBackup.INI 2013-06-14 11:50 - 2013-06-14 11:50 - 00000127 ____A C:\Windows\System32\MRT.INI 2013-06-14 11:20 - 2012-11-25 10:04 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3326214151-3358978863-4268213387-1001Core.job 2013-06-14 10:56 - 2011-08-18 17:43 - 00000000 ____D C:\Users\RalfManuela\Documents\FalkData 2013-06-14 10:28 - 2012-03-30 21:31 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-06-14 10:28 - 2011-05-13 17:51 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-06-10 09:53 - 2013-01-10 17:44 - 00005680 ____A C:\Windows\PFRO.log 2013-06-04 19:38 - 2013-05-17 15:48 - 00000000 ____D C:\Users\RalfManuela\AppData\Local\Paint.NET 2013-06-03 13:51 - 2013-06-03 12:45 - 00000000 ____D C:\Users\RalfManuela\Documents\Mount&Blade Warband Savegames 2013-06-03 12:51 - 2013-06-03 12:42 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Mount&Blade Warband 2013-06-03 12:43 - 2013-06-03 12:34 - 00000000 ____D C:\Program Files (x86)\Mount&Blade Warband 2013-06-03 12:38 - 2013-06-03 12:38 - 00001102 ____A C:\Users\RalfManuela\Desktop\Mount&Blade Warband.lnk 2013-06-03 09:09 - 2012-01-22 19:41 - 00000000 ____D C:\Users\RalfManuela\Documents\Cachen 2013-06-02 17:11 - 2011-05-13 12:37 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-06-02 15:42 - 2013-06-02 15:42 - 00218129 ____A C:\Users\RalfManuela\Downloads\h2testw_1.4_Für Micro SD Karten.zip 2013-05-31 10:42 - 2013-05-31 10:42 - 00000000 ____D C:\Users\RalfManuela\cityguide 2013-05-30 21:52 - 2013-05-05 21:36 - 00000000 ____D C:\ProgramData\PhotoStitch 2013-05-30 20:06 - 2013-05-30 20:06 - 00003352 ____N C:\bootsqm.dat 2013-05-27 17:18 - 2001-10-08 23:14 - 00078336 ____A C:\Users\RalfManuela\Downloads\Excel Password Remover.xla 2013-05-23 12:12 - 2013-02-09 19:02 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Boomzap 2013-05-20 16:26 - 2013-02-19 22:44 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Audacity 2013-05-20 16:18 - 2013-05-20 16:18 - 00000000 ____D C:\Program Files (x86)\HamRadioSoftware 2013-05-20 16:17 - 2012-11-03 19:02 - 00000000 ____D C:\Users\RalfManuela\Downloads\GeoCaching 2013-05-17 15:50 - 2013-05-17 15:50 - 00001292 ____A C:\Users\Public\Desktop\Paint.NET.lnk 2013-05-17 15:49 - 2013-05-17 15:49 - 00000000 ____D C:\Program Files\Paint.NET 2013-05-17 14:02 - 2013-03-13 22:25 - 00000000 ____D C:\Program Files (x86)\GCTool 2013-05-17 06:05 - 2013-06-14 11:53 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-05-17 05:27 - 2013-06-14 11:53 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-05-17 05:09 - 2013-06-14 11:53 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-05-17 05:02 - 2013-06-14 11:53 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-05-17 05:02 - 2013-06-14 11:53 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-05-17 05:01 - 2013-06-14 11:53 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-05-17 05:00 - 2013-06-14 11:53 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2013-05-17 04:58 - 2013-06-14 11:53 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-05-17 04:56 - 2013-06-14 11:53 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-05-17 04:56 - 2013-06-14 11:53 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-05-17 04:55 - 2013-06-14 11:53 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-05-17 04:54 - 2013-06-14 11:53 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-05-17 04:53 - 2013-06-14 11:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-05-17 04:51 - 2013-06-14 11:53 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-05-17 04:51 - 2013-06-14 11:53 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-05-17 04:46 - 2013-06-14 11:53 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-05-17 01:08 - 2013-06-14 11:53 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-05-17 00:49 - 2013-06-14 11:53 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-05-17 00:39 - 2013-06-14 11:53 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-05-17 00:28 - 2013-06-14 11:53 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-05-17 00:28 - 2013-06-14 11:53 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-05-17 00:27 - 2013-06-14 11:53 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-05-17 00:26 - 2013-06-14 11:53 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-05-17 00:23 - 2013-06-14 11:53 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-05-17 00:21 - 2013-06-14 11:53 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-05-17 00:21 - 2013-06-14 11:53 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-05-17 00:20 - 2013-06-14 11:53 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-05-17 00:19 - 2013-06-14 11:53 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-05-17 00:17 - 2013-06-14 11:53 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-05-17 00:17 - 2013-06-14 11:53 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-05-17 00:16 - 2013-06-14 11:53 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-05-17 00:12 - 2013-06-14 11:53 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-05-16 20:53 - 2013-05-16 20:53 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Hunspell 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\Documents\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Program Files (x86)\CrossADe ZeroAccess: C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5} C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5}\@ C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5}\L ZeroAccess: C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5} C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\@ C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\L C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\U Files to move or delete: ==================== C:\ProgramData\FullRemove.exe C:\ProgramData\dsgsdgdsgdsgw.pad ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2012-12-06 20:04 ==================== End Of Log ============================ und hier die von Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-06-2013 Ran by RalfManuela at 2013-06-14 19:24:24 Run: Running from C:\Users\RalfManuela\Downloads\Maleware Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) 7-Zip 9.22beta Acer Backup Manager (Version: 2.0.0.68) Acer ePower Management (Version: 5.00.3005) Acer eRecovery Management (Version: 4.05.3013) Acer GameZone Console (Version: 6.1.0.9) Acer Registration (Version: 1.03.3003) Acer ScreenSaver (Version: 1.1.0707.2010) Acer Updater (Version: 1.02.3001) Adobe Flash Player 11 ActiveX (Version: 11.7.700.224) Adobe Flash Player 11 Plugin (Version: 11.7.700.224) Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7) Adobe Shockwave Player 11.6 (Version: 11.6.3.633) Adobe SVG Viewer 3.0 (Version: 3.0) Advanced Office Password Recovery (Version: 5.4.547.483) Any Video Converter 3.3.2 ARMA 2 Operation Arrowhead Uninstall Audacity 2.0.3 (Version: 2.0.3) Avira Free Antivirus (Version: 12.0.0.898) AVNavigator (Version: VSX-921) Backup Manager Basic (Version: 2.0.0.68) bcTester 4.9 (de) (Version: 4.9.0) Big Fish Games: Game Manager (Version: 3.0.1.60) BlazeHDAV 6.0 Broadcom Gigabit NetLink Controller (Version: 14.0.2.3) CameraHelperMsi (Version: 13.00.1774.0) Canon MP Navigator EX 1.0 Canon Utilities CameraWindow DC 8 (Version: 8.9.0.4) Canon Utilities Digital Photo Professional (Version: 3.12.30.0) Canon Utilities ImageBrowser EX (Version: 1.2.1.13) Canon Utilities PhotoStitch (Version: 3.1.23.47) CCleaner (Version: 3.25) CCS64 V3.9 (Version: 1.0.0) CDBurnerXP (Version: 4.4.0.2838) Cross+A (Deutsch) (Version: 8.26.0.1041) CyberLink PowerDVD 9 (Version: 9.0.2829.50) Die*Sims™*3 (Version: 1.0.631) DivX-Setup (Version: 2.6.1.9) DTMF_Decoder 1.20 ENIGMA erLT (Version: 1.20.138.34) eSobi v2 (Version: 2.0.4.000274) Exifer Falk Device Plugin (Version: 1.0.6.0) Falk Navi-Manager (Version: 2.1.3) Falk Navi-Manager (Version: 2.7.0) Falk Navi-Manager (Version: 2.8.0) FFmpeg v0.6.2 for Audacity FILEminimizer Pictures GCTool (Version: 1.6.1) GeoGebra (Version: 4.0.31.0) GeoGebra 4.2 GeoGebraPrim Google Earth (Version: 7.0.3.8542) Grim Tales: Gefährliche Wünsche Sammleredition Groundspeak Wherigo Builder (Version: 2.0.5129) Identity Card (Version: 1.00.3003) ImagesInfo Barcode Reader Toolkit 1.9.0 Trial Intel(R) Management Engine Components (Version: 6.0.0.1179) Intel(R) Rapid Storage Technology (Version: 9.6.2.1001) Intel(R) Turbo Boost Technology Driver (Version: 01.02.00.1002) Java 7 Update 15 (64-bit) (Version: 7.0.150) Java 7 Update 17 (Version: 7.0.170) Java Auto Updater (Version: 2.1.9.0) Java SE Development Kit 7 Update 13 (64-bit) (Version: 1.7.0.130) Junk Mail filter update (Version: 14.0.8089.726) K-Lite Mega Codec Pack 8.0.0 (Version: 8.0.0) Launch Manager (Version: 4.0.12) Logitech Vid HD (Version: 7.2 (7259)) Logitech Webcam Software (Version: 2.0) LWS Facebook (Version: 13.00.1777.0) LWS Gallery (Version: 13.00.1778.0) LWS Help_main (Version: 13.00.1783.0) LWS Launcher (Version: 13.00.1776.0) LWS Motion Detection (Version: 13.00.1778.0) LWS Pictures And Video (Version: 13.00.1778.0) LWS Video Mask Maker (Version: 13.00.1774.0) LWS VideoEffects (Version: 13.00.1774.0) LWS Webcam Software (Version: 13.00.1774.0) LWS WLM Plugin (Version: 1.00.1774.0) LWS YouTube Plugin (Version: 13.00.1777.0) Magellan Communicator (Version: 1.15.020) Microsoft .NET Framework 1.1 (Version: 1.1.4322) Microsoft .NET Framework 2.0 SDK (x64) - ENU Microsoft .NET Framework 2.0 SDK (x64) - ENU (Version: 2.0.50727) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Choice Guard (Version: 2.0.48.0) Microsoft Games for Windows - LIVE Redistributable (Version: 2.0.672.0) Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000) Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0) Mobile Partner (Version: 16.002.03.01.40) Mopsos 1.0.118 28.11.2011 MopsosScript version 1.0 (Version: 1.0) Mount&Blade Warband MSVCRT (Version: 14.0.1468.721) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) MyWinLocker (Version: 3.1.212.0) MyWinLocker Suite (Version: 3.1.212.0) Napoleon: Total War NVIDIA Display Control Panel (Version: 6.14.12.5903) NVIDIA Drivers (Version: 1.10.62.40) NVIDIA PhysX (Version: 9.10.0512) OpenAL Opera 12.15 (Version: 12.15.1748) Paint.NET v3.5.10 (Version: 3.60.0) PhotoScape RealDownloader (Version: 1.3.0) RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0) RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0) RealPlayer (Version: 16.0.0) Realtek USB 2.0 Card Reader (Version: 6.1.7600.30122) RealUpgrade 1.1 (Version: 1.1.0) Shredder (Version: 2.0.8.3) SMI Grabber Device (Version: 1.0.0.26) Steam (Version: 1.0.0.0) swMSM (Version: 12.0.0.1) Synaptics Pointing Device Driver (Version: 14.0.19.0) Total Commander (Remove or Repair) (Version: 7.57a) Tropico 3 1.00 (Version: 1.00) Überwachungstool für die Intel® Turbo-Boost-Technik (Version: 1.0.186.6) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition Urwigo (Version: 1.12.0.136) VantagePoint (Version: 2.27.0000) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0) Virtual Garden VirtualCloneDrive VLC media player 1.1.9 (Version: 1.1.9) Welcome Center (Version: 1.02.3002) Windows Live Communications Platform (Version: 14.0.8064.206) Windows Live Essentials (Version: 14.0.8089.0726) Windows Live Essentials (Version: 14.0.8089.726) Windows Live Fotogalerie (Version: 14.0.8081.709) Windows Live Mail (Version: 14.0.8089.0726) Windows Live Movie Maker (Version: 14.0.8091.0730) Windows Live Writer (Version: 14.0.8089.0726) Windows Mobile-Gerätecenter (Version: 6.1.6965.0) WinZip 15.0 (Version: 15.0.9411) World of Tanks ==================== Restore Points ========================= 27-04-2013 21:51:19 Installed Groundspeak Wherigo Builder 17-05-2013 13:48:25 Paint.NET v3.5.10 03-06-2013 10:35:09 DirectX wurde installiert 14-06-2013 09:36:35 Windows Update 14-06-2013 09:45:49 Windows Update ==================== Faulty Device Manager Devices ============= Name: Microsoft-Adapter für Miniports virtueller WiFis Description: Microsoft-Adapter für Miniports virtueller WiFis Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: vwifimp Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (06/14/2013 10:56:22 AM) (Source: WcesComm) (User: ) Description: Start USB Connection (0x80004005)-Fehler beim Verbinden des Windows Mobile-basierten Geräts. (Die Daten enthalten den Fehlercode.). Error: (06/03/2013 08:27:24 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT) Description: AUSNAHMEFEHLER beim Aufruf der Funktion AVEPROC_TestFile() für die Datei C:\Users\RalfManuela\Pictures\Cachen\FOF\P1240866.JPG. [ACCESS_VIOLATION Exception!! EIP = 0x728e7f32] Bitte Avira informieren und die obige Datei übersenden! Error: (06/03/2013 08:21:44 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: ImageBrowserEX.exe, Version: 1.2.1.13, Zeitstempel: 0x5111b304 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015, Zeitstempel: 0x50b83c8a Ausnahmecode: 0xe0434352 Fehleroffset: 0x0000c41f ID des fehlerhaften Prozesses: 0x1294 Startzeit der fehlerhaften Anwendung: 0xImageBrowserEX.exe0 Pfad der fehlerhaften Anwendung: ImageBrowserEX.exe1 Pfad des fehlerhaften Moduls: ImageBrowserEX.exe2 Berichtskennung: ImageBrowserEX.exe3 Error: (06/03/2013 08:21:42 PM) (Source: .NET Runtime) (User: ) Description: Application: ImageBrowserEX.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.ObjectDisposedException Stack: at System.Windows.Forms.Control.CreateHandle() at System.Windows.Forms.Form.CreateHandle() at System.Windows.Forms.Control.get_Handle() at DCSCL.ExtensionIF.SCLInternalExtensionBase.EnableWindow4IBX(Boolean) at ap.a(System.Object, System.EventArgs) at System.Diagnostics.Process.OnExited() at System.Diagnostics.Process.RaiseOnExited() at System.Diagnostics.Process.CompletionCallback(System.Object, Boolean) at System.Threading._ThreadPoolWaitOrTimerCallback.WaitOrTimerCallback_Context(System.Object, Boolean) at System.Threading._ThreadPoolWaitOrTimerCallback.WaitOrTimerCallback_Context_f(System.Object) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading._ThreadPoolWaitOrTimerCallback.PerformWaitOrTimerCallback(System.Object, Boolean) Error: (05/29/2013 00:46:26 PM) (Source: VSS) (User: ) Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden. Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet. ], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet. ], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist. ], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet. ]. Vorgang: Asynchroner Vorgang wird ausgeführt Kontext: Aktueller Status: DoSnapshotSet Error: (05/29/2013 00:46:26 PM) (Source: VSS) (User: ) Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten. Fehlerkontext: DeviceIoControl(\\?\Volume{27b2e415-c58d-11df-9ca6-806e6f6e6963} - 0000000000000128,0x0053c010,000000000002D730,0,000000000002E740,4096,[0]). Vorgang: Schattenkopien werden übertragen Kontext: Ausführungskontext: System Provider Error: (05/17/2013 03:48:19 PM) (Source: VSS) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert . Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess. Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {f3d27bad-5de2-4ebc-824a-811c3f70af0c} Error: (05/12/2013 10:17:17 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: Stitch.exe, Version: 3.1.15.11, Zeitstempel: 0x4e6069e7 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0400000f ID des fehlerhaften Prozesses: 0x3a0 Startzeit der fehlerhaften Anwendung: 0xStitch.exe0 Pfad der fehlerhaften Anwendung: Stitch.exe1 Pfad des fehlerhaften Moduls: Stitch.exe2 Berichtskennung: Stitch.exe3 Error: (05/12/2013 10:09:12 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: ImageBrowserEX.exe, Version: 1.2.1.13, Zeitstempel: 0x5111b304 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015, Zeitstempel: 0x50b83c8a Ausnahmecode: 0xe0434352 Fehleroffset: 0x0000c41f ID des fehlerhaften Prozesses: 0x113c Startzeit der fehlerhaften Anwendung: 0xImageBrowserEX.exe0 Pfad der fehlerhaften Anwendung: ImageBrowserEX.exe1 Pfad des fehlerhaften Moduls: ImageBrowserEX.exe2 Berichtskennung: ImageBrowserEX.exe3 Error: (05/12/2013 10:09:11 AM) (Source: .NET Runtime) (User: ) Description: Application: ImageBrowserEX.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.ObjectDisposedException Stack: at System.Windows.Forms.Control.CreateHandle() at System.Windows.Forms.Form.CreateHandle() at System.Windows.Forms.Control.get_Handle() at DCSCL.ExtensionIF.SCLInternalExtensionBase.EnableWindow4IBX(Boolean) at ap.a(System.Object, System.EventArgs) at System.Diagnostics.Process.OnExited() at System.Diagnostics.Process.RaiseOnExited() at System.Diagnostics.Process.CompletionCallback(System.Object, Boolean) at System.Threading._ThreadPoolWaitOrTimerCallback.WaitOrTimerCallback_Context(System.Object, Boolean) at System.Threading._ThreadPoolWaitOrTimerCallback.WaitOrTimerCallback_Context_f(System.Object) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading._ThreadPoolWaitOrTimerCallback.PerformWaitOrTimerCallback(System.Object, Boolean) System errors: ============= Error: (05/30/2013 08:07:12 PM) (Source: EventLog) (User: ) Description: Das System wurde zuvor am ?30.?05.?2013 um 19:54:21 unerwartet heruntergefahren. Error: (05/19/2013 08:10:01 PM) (Source: iaStor) (User: ) Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error: (05/17/2013 07:38:01 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Search" wurde nicht richtig gestartet. Error: (05/12/2013 02:23:57 PM) (Source: EventLog) (User: ) Description: Das System wurde zuvor am ?12.?05.?2013 um 14:19:48 unerwartet heruntergefahren. Error: (05/04/2013 08:05:26 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error: (05/02/2013 11:05:26 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR5 gefunden. Error: (04/27/2013 08:18:11 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error: (04/21/2013 06:35:41 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR4 gefunden. Error: (04/21/2013 06:34:17 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error: (04/05/2013 05:23:46 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Microsoft Office Sessions: ========================= Error: (05/09/2012 06:48:46 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 357 seconds with 180 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Percentage of memory in use: 61% Total physical RAM: 3958.71 MB Available physical RAM: 1531.93 MB Total Pagefile: 7915.61 MB Available Pagefile: 5198.61 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:685.54 GB) (Free:112.54 GB) NTFS (Disk=0 Partition=3) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: BCFB2F0D) Partition 1: (Not Active) - (Size=13 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=686 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Ich hoffe die werden dir ein wenig helfen. |
14.06.2013, 18:52 | #4 |
/// the machine /// TB-Ausbilder | PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Fix mit FRST Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ZeroAccess: C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5} C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5}\@ C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5}\L ZeroAccess: C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5} C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\@ C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\L C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\U C:\ProgramData\FullRemove.exe C:\ProgramData\dsgsdgdsgdsgw.pad
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
14.06.2013, 19:05 | #5 |
| PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Hier die neue Auswertung: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-06-2013 Ran by RalfManuela at 2013-06-14 20:02:07 Run:1 Running from C:\Users\RalfManuela\Downloads\Maleware Boot Mode: Normal ============================================== C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5} => Moved successfully. C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5}\@ => File/Directory not found. C:\Windows\Installer\{59e9c385-1827-199a-bb08-3f75b860adb5}\L => File/Directory not found. C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5} => Moved successfully. C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\@ => File/Directory not found. C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\L => File/Directory not found. C:\Users\RalfManuela\AppData\Local\{59e9c385-1827-199a-bb08-3f75b860adb5}\U => File/Directory not found. C:\ProgramData\FullRemove.exe => Moved successfully. C:\ProgramData\dsgsdgdsgdsgw.pad => Moved successfully. ==== End of Fixlog ==== Ralf |
14.06.2013, 19:07 | #6 |
/// the machine /// TB-Ausbilder | PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST Log. Noch Probleme?
__________________ --> PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update |
15.06.2013, 08:16 | #7 |
| PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Teil II Guten Morgen Forummitglieder, habe gestern einen Thread gepostet der vom User "Schrauber" auch sofort beantwortet wurde. Siehe Link: http://www.trojaner-board.de/136602-...ml#post1086015 Würde auf dieser Seite auch gerne weiterposten, aber sobald ich auf die Seite klicke switcht die Seite immer zwischen der eigentlichen Seite und dieser Seite mit folgenden Hinweis: Die Einstellungen zur Sommer-/Winterzeit wurden aktualisiert. Falls Ihr Browser Sie nicht automatisch weiterleitet, klicken Sie bitte hier. Deshalb werde ich hier den Thread weiter machen. Folgendes habe ich gestern noch erledigt: 1.AdwCleaner 2.Junkware Removal Tool 3.ESET Online Scanner 4.SecurityCheck 5.FRST Log Hier die Logs von 1. bis 5. und einen Dank schon einmal vorab. Code:
ATTFilter # AdwCleaner v2.303 - Datei am 14/06/2013 um 20:14:34 erstellt # Aktualisiert am 08/06/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzer : RalfManuela - RALFMANUELA-PC # Bootmodus : Normal # Ausgeführt unter : C:\Users\RalfManuela\Downloads\Maleware\adwcleaner.exe # Option [Löschen] **** [Dienste] **** ***** [Dateien / Ordner] ***** Ordner Gelöscht : C:\Program Files (x86)\DealPly Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\BrowserProtect Ordner Gelöscht : C:\ProgramData\ParetoLogic Ordner Gelöscht : C:\ProgramData\Partner Ordner Gelöscht : C:\ProgramData\Tarma Installer Ordner Gelöscht : C:\Users\RalfManuela\AppData\Local\Wajam Ordner Gelöscht : C:\Users\RalfManuela\AppData\LocalLow\boost_interprocess Ordner Gelöscht : C:\Users\RalfManuela\AppData\LocalLow\Delta Ordner Gelöscht : C:\Users\RalfManuela\AppData\Roaming\Babylon Ordner Gelöscht : C:\Users\RalfManuela\AppData\Roaming\DriverCure Ordner Gelöscht : C:\Users\RalfManuela\AppData\Roaming\ParetoLogic ***** [Registrierungsdatenbank] ***** Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16490 [OK] Die Registrierungsdatenbank ist sauber. -\\ Google Chrome v [Version kann nicht ermittelt werden] Datei : C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] Die Datei ist sauber. -\\ Opera v12.15.1748.0 Datei : C:\Users\RalfManuela\AppData\Roaming\Opera\Opera\operaprefs.ini [OK] Die Datei ist sauber. ************************* AdwCleaner[S1].txt - [1757 octets] - [14/06/2013 20:14:34] ########## EOF - C:\AdwCleaner[S1].txt - [1817 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.9.4 (05.06.2013:1) OS: Windows 7 Home Premium x64 Ran by RalfManuela on 14.06.2013 at 20:27:53,09 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files Successfully deleted: [File] C:\eula.1028.txt Successfully deleted: [File] C:\eula.1031.txt Successfully deleted: [File] C:\eula.1033.txt Successfully deleted: [File] C:\eula.1036.txt Successfully deleted: [File] C:\eula.1040.txt Successfully deleted: [File] C:\eula.1041.txt Successfully deleted: [File] C:\eula.1042.txt Successfully deleted: [File] C:\eula.2052.txt Successfully deleted: [File] C:\install.res.1028.dll Successfully deleted: [File] C:\install.res.1031.dll Successfully deleted: [File] C:\install.res.1033.dll Successfully deleted: [File] C:\install.res.1036.dll Successfully deleted: [File] C:\install.res.1040.dll Successfully deleted: [File] C:\install.res.1041.dll Successfully deleted: [File] C:\install.res.1042.dll Successfully deleted: [File] C:\install.res.2052.dll Successfully deleted: [File] C:\install.res.3082.dll ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\big fish games" ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 14.06.2013 at 20:31:17,22 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=b32de9f89557d54b98e912e63f920a84 # engine=14075 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-06-14 10:37:34 # local_time=2013-06-15 12:37:34 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1799 16775165 100 99 39650 117019937 45087 0 # compatibility_mode=5893 16776573 100 94 15389 122879304 0 0 # scanned=359154 # found=4 # cleaned=0 # scan_time=14552 sh=7644F09E2CD4505CA33B11C458C5A30B40FE309C ft=1 fh=17460ab88b0e78e8 vn="a variant of Win32/Kryptik.BBYX trojan" ac=I fn="C:\Users\RalfManuela\AppData\Local\Temp\22A4.tmp" sh=CE22E08D66D037109986FA76A4D502F57F2B1152 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.OKM trojan" ac=I fn="C:\Users\RalfManuela\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\1d56fe92-72887c7d" sh=5A7E3D648E03DDA669CAB7067F6822D2F3C008F7 ft=1 fh=b44b1209822a7938 vn="a variant of Win32/Kryptik.BCKO trojan" ac=I fn="C:\Users\RalfManuela\AppData\Roaming\Azyj\ojqyik.exe" sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="a variant of Win32/Packed.VMProtect.AAA trojan" ac=I fn="C:\Users\RalfManuela\Spiele\Tom Clancys Splinter Cell - Conviction\Neuer Ordner\sr-tcscc.iso" Code:
ATTFilter Results of screen317's Security Check version 0.99.64 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 17 Java version out of Date! Adobe Flash Player 11.7.700.224 Adobe Reader 10.1.7 Adobe Reader out of Date! Google Chrome 22.0.1229.95 ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe RalfManuela Downloads Maleware SecurityCheck.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-06-2013 Ran by RalfManuela (administrator) on 15-06-2013 08:45:08 Running from C:\Users\RalfManuela\Downloads\Maleware Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Logitech Inc.) C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (Logitech Inc.) C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe () C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe ==================== Registry (Whitelisted) ================== HKCU\...\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation) HKCU\...\Run: [Google Update] "C:\Users\RalfManuela\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-11-25] (Google Inc.) HKCU\...\Policies\system: [DisableRegistryTools] 0 HKCU\...\Policies\system: [DisableTaskMgr] 0 MountPoints2: F - F:\AutoRun.exe MountPoints2: H - H:\AutoRun.exe MountPoints2: {07aebfa7-66b5-11e1-8b7d-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {116e20f6-5960-11e1-bbf7-88ae1da3f0f3} - F:\AutoRun.exe MountPoints2: {116e2114-5960-11e1-bbf7-88ae1da3f0f3} - F:\AutoRun.exe MountPoints2: {2b3d24d3-7365-11e1-86e6-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {68092108-6765-11e1-90e8-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {7c21132c-9289-11e0-8508-88ae1da3f0f3} - E:\Setup.exe MountPoints2: {c93614e2-8a21-11e1-a7df-4c0f6e89b879} - F:\AutoRun.exe MountPoints2: {d2cb3ce9-87d5-11e1-b1ef-4c0f6e89b879} - H:\AutoRun.exe MountPoints2: {e88dce07-df72-11e0-a9e9-4c0f6e89b879} - F:\LaunchU3.exe -a HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [265984 2010-06-28] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [258512 2012-01-31] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-15] () HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-15] () Startup: C:\ProgramData\Start Menu\Programs\Startup\ImageBrowser EX Agent.lnk ShortcutTarget: ImageBrowser EX Agent.lnk -> C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://gmx.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273605119315l04h4z1i5v47m22902 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {B1953AD6-C50E-11D3-B020-00A0C9251384} hxxp://www.o2c.de/download/o2cplayer.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} DPF: HKLM-x32 {E4CF4E86-D0DC-4864-8F0E-4F6EA2526334} https://img.ui-portal.de/webde/smartdrive/activex/gmxnet_osupload_2002.cab Tcpip\..\Interfaces\{49F83F9E-C33B-4DCC-9FDE-8A0599FFF673}: [NameServer]192.168.1.1 Tcpip\..\Interfaces\{4B3812D0-B847-4C00-B369-9A7A58ADAD30}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{67BBAC55-A6B2-40A7-B2D7-5728B8251FE7}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{6B6261FB-FF7D-4EDC-9DD4-CEB02432427F}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{95AC8154-8DCA-429B-9236-B3FB9717E7D4}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{D6BE1B99-CFD7-477B-9CFF-AA71AD37B55F}: [NameServer]193.189.244.206 193.189.244.225 Tcpip\..\Interfaces\{E9E93C80-E306-43FC-BF7F-C66C88999966}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{FBE8EDFF-40B4-4F01-B66D-8CE039DB5E4E}: [NameServer]192.168.1.1 Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR RestoreOnStartup: "hxxp://www.google.com/" CHR Extension: (YouTube) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0 CHR Extension: (Google Search) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0 CHR Extension: (RealDownloader) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.0_0 CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0 CHR Extension: (Gmail) - C:\Users\RalfManuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-01-31] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-01-31] (Avira Operations GmbH & Co. KG) R2 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97312 2012-01-31] (Avira GmbH) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132320 2012-01-31] (Avira GmbH) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-16] (Avira GmbH) S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [246224 2009-12-07] (Huawei Technologies Co., Ltd.) S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.) R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] () S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] () S3 SMIGrabber3C; C:\Windows\System32\Drivers\SmiUsbGrabber3C.sys [811520 2009-05-14] (Windows (R) Win 7 DDK provider) R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] () S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-06-14 20:27 - 2013-06-14 20:27 - 00000000 ____D C:\Windows\ERUNT 2013-06-14 20:14 - 2013-06-14 20:15 - 00001886 ____A C:\AdwCleaner[S1].txt 2013-06-14 20:09 - 2013-06-14 20:27 - 00000000 ____D C:\JRT 2013-06-14 19:23 - 2013-06-14 19:23 - 00000000 ____D C:\FRST 2013-06-14 19:20 - 2013-06-14 19:23 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-06-14 19:17 - 2013-06-14 19:17 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-06-14 17:54 - 2013-06-14 23:40 - 00178688 ____H C:\Users\RalfManuela\Documents\~WRL0002.tmp 2013-06-14 17:54 - 2013-06-14 17:54 - 00035328 ____H C:\Users\RalfManuela\Documents\~WRL0005.tmp 2013-06-14 13:48 - 2013-06-14 13:48 - 00000000 ____A C:\Users\RalfManuela\defogger_reenable 2013-06-14 11:54 - 2012-07-26 06:55 - 00785512 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys 2013-06-14 11:54 - 2012-07-26 06:55 - 00054376 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WdfLdr.sys 2013-06-14 11:54 - 2012-07-26 04:36 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\Wdfres.dll 2013-06-14 11:54 - 2012-06-02 16:35 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf 2013-06-14 11:53 - 2013-05-17 06:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-06-14 11:53 - 2013-05-17 05:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-06-14 11:53 - 2013-05-17 05:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-06-14 11:53 - 2013-05-17 05:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-06-14 11:53 - 2013-05-17 05:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-06-14 11:53 - 2013-05-17 05:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-06-14 11:53 - 2013-05-17 05:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2013-06-14 11:53 - 2013-05-17 04:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-06-14 11:53 - 2013-05-17 04:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-06-14 11:53 - 2013-05-17 04:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-06-14 11:53 - 2013-05-17 04:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-06-14 11:53 - 2013-05-17 04:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-06-14 11:53 - 2013-05-17 04:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-06-14 11:53 - 2013-05-17 04:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-06-14 11:53 - 2013-05-17 04:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-06-14 11:53 - 2013-05-17 04:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-06-14 11:53 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-06-14 11:53 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-06-14 11:53 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-06-14 11:53 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-06-14 11:53 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-06-14 11:53 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-06-14 11:53 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-06-14 11:53 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-06-14 11:53 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-06-14 11:53 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-06-14 11:53 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-06-14 11:53 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-06-14 11:53 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-06-14 11:53 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-06-14 11:53 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-06-14 11:53 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-06-14 11:50 - 2013-06-14 11:50 - 00000127 ____A C:\Windows\System32\MRT.INI 2013-06-14 11:46 - 2012-07-26 05:08 - 00744448 ____A (Microsoft Corporation) C:\Windows\System32\WUDFx.dll 2013-06-14 11:46 - 2012-07-26 05:08 - 00229888 ____A (Microsoft Corporation) C:\Windows\System32\WUDFHost.exe 2013-06-14 11:46 - 2012-07-26 05:08 - 00194048 ____A (Microsoft Corporation) C:\Windows\System32\WUDFPlatform.dll 2013-06-14 11:46 - 2012-07-26 05:08 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\WUDFSvc.dll 2013-06-14 11:46 - 2012-07-26 05:08 - 00045056 ____A (Microsoft Corporation) C:\Windows\System32\WUDFCoinstaller.dll 2013-06-14 11:46 - 2012-07-26 04:26 - 00198656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFRd.sys 2013-06-14 11:46 - 2012-07-26 04:26 - 00087040 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFPf.sys 2013-06-14 11:46 - 2012-06-02 16:57 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2013-06-14 11:40 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2013-06-14 11:40 - 2013-04-12 16:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys 2013-06-14 11:40 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2013-06-14 11:40 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys 2013-06-14 11:40 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll 2013-06-14 11:40 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll 2013-06-14 11:40 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2013-06-14 11:40 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll 2013-06-14 11:39 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe 2013-06-14 11:39 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll 2013-06-14 11:39 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll 2013-06-14 11:39 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll 2013-06-14 11:39 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2013-06-14 11:39 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2013-06-14 11:39 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-06-14 11:38 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-06-14 11:38 - 2013-02-12 06:12 - 00019968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys 2013-06-14 11:37 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll 2013-06-14 11:37 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll 2013-06-14 11:37 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll 2013-06-14 11:37 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll 2013-06-14 11:37 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-06-14 11:37 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-06-14 11:37 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-06-14 11:37 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe 2013-06-14 11:37 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe 2013-06-14 11:37 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll 2013-06-14 11:37 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll 2013-06-14 11:37 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll 2013-06-14 11:37 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll 2013-06-14 11:37 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2013-06-14 11:37 - 2013-01-24 08:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys 2013-06-03 12:45 - 2013-06-03 13:51 - 00000000 ____D C:\Users\RalfManuela\Documents\Mount&Blade Warband Savegames 2013-06-03 12:42 - 2013-06-03 12:51 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Mount&Blade Warband 2013-06-03 12:38 - 2013-06-03 12:38 - 00001102 ____A C:\Users\RalfManuela\Desktop\Mount&Blade Warband.lnk 2013-06-03 12:34 - 2013-06-03 12:43 - 00000000 ____D C:\Program Files (x86)\Mount&Blade Warband 2013-06-02 15:42 - 2013-06-02 15:42 - 00218129 ____A C:\Users\RalfManuela\Downloads\h2testw_1.4_Für Micro SD Karten.zip 2013-05-31 10:42 - 2013-05-31 10:42 - 00000000 ____D C:\Users\RalfManuela\cityguide 2013-05-30 20:06 - 2013-05-30 20:06 - 00003352 ____N C:\bootsqm.dat 2013-05-20 16:18 - 2013-05-20 16:18 - 00000000 ____D C:\Program Files (x86)\HamRadioSoftware 2013-05-17 15:50 - 2013-05-17 15:50 - 00001292 ____A C:\Users\Public\Desktop\Paint.NET.lnk 2013-05-17 15:49 - 2013-05-17 15:49 - 00000000 ____D C:\Program Files\Paint.NET 2013-05-17 15:48 - 2013-06-04 19:38 - 00000000 ____D C:\Users\RalfManuela\AppData\Local\Paint.NET 2013-05-16 20:53 - 2013-05-16 20:53 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Hunspell 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\Documents\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Program Files (x86)\CrossADe ==================== One Month Modified Files and Folders ======= 2013-06-15 08:28 - 2012-03-30 21:32 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-06-15 08:24 - 2009-07-14 06:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-06-15 08:24 - 2009-07-14 06:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-06-15 08:21 - 2010-09-21 16:38 - 01631981 ____A C:\Windows\WindowsUpdate.log 2013-06-15 08:20 - 2012-11-25 10:04 - 00001144 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3326214151-3358978863-4268213387-1001UA.job 2013-06-15 08:16 - 2013-02-09 16:34 - 00017018 ____A C:\Windows\setupact.log 2013-06-15 08:16 - 2011-05-12 16:36 - 00000000 ____D C:\Windows\SysWOW64\logishrd 2013-06-15 08:16 - 2011-05-12 16:36 - 00000000 ____D C:\Windows\System32\logishrd 2013-06-15 08:16 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-06-15 08:15 - 2013-01-10 17:44 - 00006506 ____A C:\Windows\PFRO.log 2013-06-15 00:55 - 2010-09-22 02:28 - 00664868 ____A C:\Windows\System32\perfh007.dat 2013-06-15 00:55 - 2010-09-22 02:28 - 00135004 ____A C:\Windows\System32\perfc007.dat 2013-06-15 00:55 - 2009-07-14 07:13 - 01549542 ____A C:\Windows\System32\PerfStringBackup.INI 2013-06-15 00:53 - 2011-06-01 17:13 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-06-14 23:40 - 2013-06-14 17:54 - 00178688 ____H C:\Users\RalfManuela\Documents\~WRL0002.tmp 2013-06-14 20:31 - 2013-03-21 23:00 - 00000000 ____D C:\Users\RalfManuela\Downloads\Maleware 2013-06-14 20:27 - 2013-06-14 20:27 - 00000000 ____D C:\Windows\ERUNT 2013-06-14 20:27 - 2013-06-14 20:09 - 00000000 ____D C:\JRT 2013-06-14 20:15 - 2013-06-14 20:14 - 00001886 ____A C:\AdwCleaner[S1].txt 2013-06-14 20:13 - 2011-10-20 11:11 - 00000000 ____D C:\Users\RalfManuela\Documents\Ralf 2013-06-14 19:23 - 2013-06-14 19:23 - 00000000 ____D C:\FRST 2013-06-14 19:23 - 2013-06-14 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-06-14 19:17 - 2013-06-14 19:17 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-06-14 17:54 - 2013-06-14 17:54 - 00035328 ____H C:\Users\RalfManuela\Documents\~WRL0005.tmp 2013-06-14 13:48 - 2013-06-14 13:48 - 00000000 ____A C:\Users\RalfManuela\defogger_reenable 2013-06-14 13:48 - 2011-05-12 16:02 - 00000000 ____D C:\users\RalfManuela 2013-06-14 13:39 - 2009-07-14 06:45 - 00348640 ____A C:\Windows\System32\FNTCACHE.DAT 2013-06-14 13:36 - 2011-05-15 03:18 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Gurewu 2013-06-14 11:50 - 2013-06-14 11:50 - 00000127 ____A C:\Windows\System32\MRT.INI 2013-06-14 11:20 - 2012-11-25 10:04 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3326214151-3358978863-4268213387-1001Core.job 2013-06-14 10:56 - 2011-08-18 17:43 - 00000000 ____D C:\Users\RalfManuela\Documents\FalkData 2013-06-14 10:28 - 2012-03-30 21:31 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-06-14 10:28 - 2011-05-13 17:51 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-06-04 19:38 - 2013-05-17 15:48 - 00000000 ____D C:\Users\RalfManuela\AppData\Local\Paint.NET 2013-06-03 13:51 - 2013-06-03 12:45 - 00000000 ____D C:\Users\RalfManuela\Documents\Mount&Blade Warband Savegames 2013-06-03 12:51 - 2013-06-03 12:42 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Mount&Blade Warband 2013-06-03 12:43 - 2013-06-03 12:34 - 00000000 ____D C:\Program Files (x86)\Mount&Blade Warband 2013-06-03 12:38 - 2013-06-03 12:38 - 00001102 ____A C:\Users\RalfManuela\Desktop\Mount&Blade Warband.lnk 2013-06-03 09:09 - 2012-01-22 19:41 - 00000000 ____D C:\Users\RalfManuela\Documents\Cachen 2013-06-02 17:11 - 2011-05-13 12:37 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-06-02 15:42 - 2013-06-02 15:42 - 00218129 ____A C:\Users\RalfManuela\Downloads\h2testw_1.4_Für Micro SD Karten.zip 2013-05-31 10:42 - 2013-05-31 10:42 - 00000000 ____D C:\Users\RalfManuela\cityguide 2013-05-30 21:52 - 2013-05-05 21:36 - 00000000 ____D C:\ProgramData\PhotoStitch 2013-05-30 20:06 - 2013-05-30 20:06 - 00003352 ____N C:\bootsqm.dat 2013-05-27 17:18 - 2001-10-08 23:14 - 00078336 ____A C:\Users\RalfManuela\Downloads\Excel Password Remover.xla 2013-05-23 12:12 - 2013-02-09 19:02 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Boomzap 2013-05-20 16:26 - 2013-02-19 22:44 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Audacity 2013-05-20 16:18 - 2013-05-20 16:18 - 00000000 ____D C:\Program Files (x86)\HamRadioSoftware 2013-05-20 16:17 - 2012-11-03 19:02 - 00000000 ____D C:\Users\RalfManuela\Downloads\GeoCaching 2013-05-17 15:50 - 2013-05-17 15:50 - 00001292 ____A C:\Users\Public\Desktop\Paint.NET.lnk 2013-05-17 15:49 - 2013-05-17 15:49 - 00000000 ____D C:\Program Files\Paint.NET 2013-05-17 14:02 - 2013-03-13 22:25 - 00000000 ____D C:\Program Files (x86)\GCTool 2013-05-17 06:05 - 2013-06-14 11:53 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-05-17 05:27 - 2013-06-14 11:53 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-05-17 05:09 - 2013-06-14 11:53 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-05-17 05:02 - 2013-06-14 11:53 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-05-17 05:02 - 2013-06-14 11:53 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-05-17 05:01 - 2013-06-14 11:53 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-05-17 05:00 - 2013-06-14 11:53 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2013-05-17 04:58 - 2013-06-14 11:53 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-05-17 04:56 - 2013-06-14 11:53 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-05-17 04:56 - 2013-06-14 11:53 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-05-17 04:55 - 2013-06-14 11:53 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-05-17 04:54 - 2013-06-14 11:53 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-05-17 04:53 - 2013-06-14 11:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-05-17 04:51 - 2013-06-14 11:53 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-05-17 04:51 - 2013-06-14 11:53 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-05-17 04:46 - 2013-06-14 11:53 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-05-17 01:08 - 2013-06-14 11:53 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-05-17 00:49 - 2013-06-14 11:53 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-05-17 00:39 - 2013-06-14 11:53 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-05-17 00:28 - 2013-06-14 11:53 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-05-17 00:28 - 2013-06-14 11:53 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-05-17 00:27 - 2013-06-14 11:53 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-05-17 00:26 - 2013-06-14 11:53 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-05-17 00:23 - 2013-06-14 11:53 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-05-17 00:21 - 2013-06-14 11:53 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-05-17 00:21 - 2013-06-14 11:53 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-05-17 00:20 - 2013-06-14 11:53 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-05-17 00:19 - 2013-06-14 11:53 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-05-17 00:17 - 2013-06-14 11:53 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-05-17 00:17 - 2013-06-14 11:53 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-05-17 00:16 - 2013-06-14 11:53 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-05-17 00:12 - 2013-06-14 11:53 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-05-16 20:53 - 2013-05-16 20:53 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Hunspell 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\Documents\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Users\RalfManuela\AppData\Roaming\Cross+A 2013-05-16 20:52 - 2013-05-16 20:52 - 00000000 ____D C:\Program Files (x86)\CrossADe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2012-12-06 20:04 ==================== End Of Log ============================ Mal schauen was nun noch gemacht werden muss. Gruß Ralf |
15.06.2013, 09:31 | #8 |
/// the machine /// TB-Ausbilder | PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Fix mit FRST Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\RalfManuela\AppData\Roaming\Azyj C:\Users\RalfManuela\AppData\Roaming\Gurewu
Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
15.06.2013, 10:29 | #9 |
| PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Hier ersteinmal die aauswertung vom FRST: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-06-2013 Ran by RalfManuela at 2013-06-15 11:26:18 Run:3 Running from C:\Users\RalfManuela\Downloads\Maleware Boot Mode: Normal ============================================== C:\Users\RalfManuela\AppData\Roaming\Azyj => Moved successfully. C:\Users\RalfManuela\AppData\Roaming\Gurewu => Moved successfully. ==== End of Fixlog ==== Danke Ralf Das Programm TFC habe ich nun durchlaufen lassen. Gehe ich recht in der Annahme, dass es nun vollbracht ist. ;-) Wenn dem so ist, dann einen recht herzlichen Dank für deine sehr schnelle Hilfe. Gruß Ralf |
15.06.2013, 11:00 | #10 |
/// the machine /// TB-Ausbilder | PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Jap, fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob/Kritik loswerden möchtest: Lob, Kritik und Wünsche - Trojaner-Board Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
15.06.2013, 12:19 | #11 |
| PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Es bleibt mir hier nur noch eines zu schreiben: DANKE für die super Hilfe Gruß Ralf |
15.06.2013, 14:41 | #12 |
/// the machine /// TB-Ausbilder | PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu PWS:Win32/Zbot.gen!Y Meldung, nach Windows Update |
administrator, downloader, explorer, internet explorer, java/exploit.agent.okm, problem, programme, pws:win32/zbot.gen!y, scanner, services.exe, software, svchost.exe, temp, thread, troja, trojaners, updates, win32/kryptik.bbyx, win32/kryptik.bcko, win32/packed.vmprotect.aaa, win32/zbot.gen!y, windows, windows update, winlogon.exe |