| |
| |||||||
Log-Analyse und Auswertung: Interpol Trojaner - Rechner gesperrt - wie bekomme ich den weg ?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
12.08.2013, 22:34
| #1 |
| |  Interpol Trojaner - Rechner gesperrt - wie bekomme ich den weg ? Moin, mich hat es auch mal mit diesem fiesen Trojaner (Interpol) erwischt. Dank einiger Meldungen meiner Mitleidenden, habe ich schon mal ein wenig versucht. Habt ihr noch einen Tipp für mich ? ADW Cleaner: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 12/08/2013 um 22:17:17 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzer : Teske - TESKE-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Teske\Downloads\adwcleaner06.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
*************************
AdwCleaner[R1].txt - [608 octets] - [12/08/2013 22:17:17]
########## EOF - C:\AdwCleaner[R1].txt - [667 octets] ##########
Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.12.05 Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 10.0.9200.16635 Teske :: TESKE-PC [Administrator] Schutz: Deaktiviert 12.08.2013 21:57:23 mbam-log-2013-08-12 (21-57-23).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 202300 Laufzeit: 2 Minute(n), 49 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\Teske\AppData\Local\Temp\1jfuweif.exe (Trojan.Agent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Teske\AppData\Local\Temp\hovphsiiqlhcvjhebpl.bfg (Trojan.WinLock.RRE) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Teske\AppData\Local\Temp\jar_cache4824873794731091743.tmp (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Spybot S&D Code:
ATTFilter Search results from Spybot - Search & Destroy
12.08.2013 21:49:46
Scan took 00:12:58.
12 items found.
Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Teske\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\VARN3LBZ\mpsnare.iesnare.com\stm.sol
Properties.size=79
Properties.md5=E7F70AD9C9510BE0D870EC8527F604D6
Properties.filedate=1376333895
Properties.filedatetext=2013-08-12 20:58:14
Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7] Text file (File, nothing done)
C:\Users\Teske\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\VARN3LBZ\heias.com\x\heias_sc.swf\heias.sol
Properties.size=62
Properties.md5=C9FFD1FA506EE1A3B1B92F221A0C2345
Properties.filedate=1376335745
Properties.filedatetext=2013-08-12 21:29:04
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (User): Teske) (Browser: Cookie, nothing done)
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (User): Teske) (Browser: Cookie, nothing done)
MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name
MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name
MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id
Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-272256979-2995323171-1074692639-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Cookie: [SBI $49804B54] Browser: Cookie (64) (Browser: Cookie, nothing done)
Cache: [SBI $49804B54] Browser: Cache (89) (Browser: Cache, nothing done)
--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---
2013-05-16 SDBootCD.exe (2.1.18.109)
2013-05-16 SDCleaner.exe (2.1.18.110)
2013-05-16 SDDelFile.exe (2.1.18.94)
2013-05-16 SDFSSvc.exe (2.1.18.208)
2013-03-20 SDFileScanHelper.exe (2.1.16.1)
2013-05-16 SDFiles.exe (2.1.18.135)
2013-05-16 SDHookHelper.exe (2.1.18.2)
2013-05-16 SDHookInst32.exe (2.1.18.2)
2013-05-16 SDImmunize.exe (2.1.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-05-16 SDOnAccess.exe (2.1.18.4)
2013-05-16 SDPESetup.exe (2.1.18.3)
2013-05-16 SDPEStart.exe (2.1.18.86)
2013-05-16 SDPRE.exe (2.1.18.22)
2013-05-16 SDPhoneScan.exe (2.1.18.28)
2013-05-16 SDPrepPos.exe (2.1.18.10)
2013-05-16 SDQuarantine.exe (2.1.18.103)
2013-05-16 SDRootAlyzer.exe (2.1.18.116)
2013-05-16 SDSBIEdit.exe (2.1.18.39)
2013-05-16 SDScan.exe (2.1.18.177)
2013-05-16 SDScript.exe (2.1.18.53)
2013-05-16 SDSettings.exe (2.1.18.136)
2013-05-16 SDShell.exe (2.1.18.2)
2013-05-16 SDShred.exe (2.1.18.107)
2013-05-16 SDSysRepair.exe (2.1.18.101)
2013-05-16 SDTools.exe (2.1.18.150)
2013-05-16 SDTray.exe (2.1.18.127)
2013-05-16 SDUpdSvc.exe (2.1.18.76)
2013-05-16 SDUpdate.exe (2.1.18.91)
2013-05-15 SDWSCSvc.exe (2.1.18.2)
2013-05-16 SDWelcome.exe (2.1.18.129)
2013-05-16 blindman.exe (2.1.18.151)
2013-05-16 explorer.exe (2.1.18.177)
2013-05-24 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2013-06-18 SDDisableProxy.exe
2013-06-19 spybotsd2-translation-frx.exe
2012-09-05 DelZip190.dll (1.9.0.107)
2013-05-16 SDAV.dll
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDECon32.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-05-16 SDFileScanLibrary.dll (2.1.18.12)
2013-05-16 SDHook32.dll (2.1.18.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2013-05-16 Tools.dll (2.1.18.36)
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2012-12-18 Includes\Adware.sbi (*)
2013-07-30 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-08-06 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-08-06 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-07-31 Includes\TrojansC-03.sbi (*)
2013-08-06 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
FRST Log: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-08-2013 Ran by Teske (administrator) on 12-08-2013 22:33:21 Running from H:\ Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Safe Mode (with Networking) ==================== Could not list processes =============== ==================== Registry (Whitelisted) ================== HKLM\...\Run: [LogitechQuickCamRibbon] - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] () HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [348664 2012-07-18] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9874024 2010-11-19] (Realtek Semiconductor) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [149280 2013-06-21] (Sun Microsystems, Inc.) HKLM\...\Runonce: [GrpConv] - grpconv -o [x] HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [Logitech Vid] - C:\Program Files\Logitech\Logitech Vid\vid.exe [5458704 2009-07-16] (Logitech Inc.) HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.) HKCU\...\RunOnce: [Report] - C:\AdwCleaner[S1].txt [796 2013-08-12] () Startup: C:\Users\Teske\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lpbehjvchlqiishpvoh.lnk ShortcutTarget: lpbehjvchlqiishpvoh.lnk -> C:\Users\Teske\AppData\Local\Temp\hovphsiiqlhcvjhebpl.bfg (No File) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {60B8CC35-639C-4C2F-B1D0-373B79FC852D} URL = hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) Handler: msdaipp - No CLSID Value - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 ========================== Services (Whitelisted) ================= S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG) S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S2 Winmgmt; C:\PROGRA~3\hovphsiiqlhcvjhebpl.bfg [x] ==================== Drivers (Whitelisted) ==================== S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83392 2012-07-18] (Avira GmbH) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137928 2012-07-18] (Avira GmbH) S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2012-07-18] (Avira GmbH) R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider) S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] () S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [13216 2009-07-17] () S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-12 22:26 - 2013-08-12 22:26 - 00000000 ____D C:\Windows\ERUNT 2013-08-12 22:21 - 2013-08-12 22:21 - 00959697 _____ (Oleg N. Scherbakov) C:\Users\Teske\Downloads\JRT_5.4.4.exe 2013-08-12 22:20 - 2013-08-12 22:17 - 00000735 _____ C:\Users\Teske\Desktop\AdwCleaner[R1].txt 2013-08-12 22:17 - 2013-08-12 22:17 - 00666633 _____ C:\Users\Teske\Downloads\adwcleaner06.exe 2013-08-12 22:17 - 2013-08-12 22:17 - 00000796 _____ C:\AdwCleaner[S1].txt 2013-08-12 22:17 - 2013-08-12 22:17 - 00000735 _____ C:\AdwCleaner[R1].txt 2013-08-12 21:51 - 2013-08-12 21:51 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Malwarebytes 2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-08-12 21:51 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-08-12 21:28 - 2013-08-12 21:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Teske\Downloads\mbam-setup-1.75.0.1300.exe 2013-08-12 21:08 - 2013-08-12 21:08 - 00000036 _____ C:\Users\Teske\AppData\Local\housecall.guid.cache 2013-08-12 21:04 - 2011-12-13 09:35 - 00031552 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe 2013-08-12 21:04 - 2011-12-13 09:29 - 00029504 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll 2013-08-12 21:04 - 2011-12-13 09:29 - 00021312 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll 2013-08-12 21:03 - 2013-08-12 21:03 - 00002155 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk 2013-08-12 21:02 - 2013-08-12 21:03 - 00000000 ____D C:\Program Files\TuneUp Utilities 2011 2013-08-12 21:02 - 2013-08-12 21:02 - 00000000 ____D C:\Users\Teske\AppData\Roaming\TuneUp Software 2013-08-12 21:01 - 2013-08-12 21:02 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-08-12 21:01 - 2013-08-12 21:01 - 00000000 __SHD C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} 2013-08-12 21:00 - 2013-08-12 21:01 - 24038304 _____ (TuneUp Software) C:\Users\Teske\Downloads\TuneUpUtilities2011_de-DE.exe 2013-08-12 19:43 - 2013-08-12 19:43 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-08-12 19:41 - 2013-08-12 21:47 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP 2013-08-12 19:41 - 2013-08-12 19:41 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard 2013-08-08 15:06 - 2013-08-08 15:06 - 00000000 ____D C:\FRST 2013-08-08 14:24 - 2013-08-08 14:48 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-08 14:24 - 2013-08-08 14:24 - 00000000 ____D C:\Users\Teske\Documents\ProcAlyzer Dumps 2013-08-08 14:04 - 2013-08-08 14:05 - 00031232 ___SH C:\Users\Teske\Documents\Thumbs.db ==================== One Month Modified Files and Folders ======= 2013-08-12 22:26 - 2013-08-12 22:26 - 00000000 ____D C:\Windows\ERUNT 2013-08-12 22:21 - 2013-08-12 22:21 - 00959697 _____ (Oleg N. Scherbakov) C:\Users\Teske\Downloads\JRT_5.4.4.exe 2013-08-12 22:17 - 2013-08-12 22:20 - 00000735 _____ C:\Users\Teske\Desktop\AdwCleaner[R1].txt 2013-08-12 22:17 - 2013-08-12 22:17 - 00666633 _____ C:\Users\Teske\Downloads\adwcleaner06.exe 2013-08-12 22:17 - 2013-08-12 22:17 - 00000796 _____ C:\AdwCleaner[S1].txt 2013-08-12 22:17 - 2013-08-12 22:17 - 00000735 _____ C:\AdwCleaner[R1].txt 2013-08-12 22:12 - 2012-09-06 21:13 - 00098238 _____ C:\Windows\PFRO.log 2013-08-12 21:51 - 2013-08-12 21:51 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Malwarebytes 2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-08-12 21:51 - 2013-08-12 21:51 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-08-12 21:47 - 2013-08-12 19:41 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP 2013-08-12 21:29 - 2013-08-12 21:28 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Teske\Downloads\mbam-setup-1.75.0.1300.exe 2013-08-12 21:08 - 2013-08-12 21:08 - 00000036 _____ C:\Users\Teske\AppData\Local\housecall.guid.cache 2013-08-12 21:03 - 2013-08-12 21:03 - 00002155 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk 2013-08-12 21:03 - 2013-08-12 21:02 - 00000000 ____D C:\Program Files\TuneUp Utilities 2011 2013-08-12 21:02 - 2013-08-12 21:02 - 00000000 ____D C:\Users\Teske\AppData\Roaming\TuneUp Software 2013-08-12 21:02 - 2013-08-12 21:01 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-08-12 21:01 - 2013-08-12 21:01 - 00000000 __SHD C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} 2013-08-12 21:01 - 2013-08-12 21:00 - 24038304 _____ (TuneUp Software) C:\Users\Teske\Downloads\TuneUpUtilities2011_de-DE.exe 2013-08-12 19:43 - 2013-08-12 19:43 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-08-12 19:41 - 2013-08-12 19:41 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard 2013-08-08 21:44 - 2012-09-06 21:03 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Skype 2013-08-08 20:53 - 2012-09-06 19:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-08 20:53 - 2012-09-06 17:46 - 01633328 _____ C:\Windows\WindowsUpdate.log 2013-08-08 17:34 - 2009-07-14 06:34 - 00018624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-08 17:34 - 2009-07-14 06:34 - 00018624 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-08 17:26 - 2012-09-06 18:52 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs 2013-08-08 17:26 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-08 17:26 - 2009-07-14 06:39 - 00053388 _____ C:\Windows\setupact.log 2013-08-08 15:06 - 2013-08-08 15:06 - 00000000 ____D C:\FRST 2013-08-08 14:54 - 2012-09-06 17:55 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI 2013-08-08 14:48 - 2013-08-08 14:24 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-08 14:24 - 2013-08-08 14:24 - 00000000 ____D C:\Users\Teske\Documents\ProcAlyzer Dumps 2013-08-08 14:18 - 2013-05-29 21:43 - 00000000 ____D C:\Users\Teske\AppData\Roaming\Dropbox 2013-08-08 14:05 - 2013-08-08 14:04 - 00031232 ___SH C:\Users\Teske\Documents\Thumbs.db 2013-08-08 13:28 - 2013-05-29 21:48 - 00000000 ___RD C:\Users\Teske\Dropbox 2013-08-08 07:47 - 2012-09-06 19:10 - 00000000 ____D C:\Users\Teske\AppData\Local\Windows Live 2013-08-08 07:15 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-08-01 15:51 - 2012-09-17 19:17 - 00000000 ____D C:\Users\Teske\hob_jportal 2013-07-17 06:50 - 2013-03-07 09:47 - 00000000 ___RD C:\Program Files\Skype 2013-07-17 06:50 - 2012-09-06 21:03 - 00000000 ____D C:\ProgramData\Skype 2013-07-14 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET 2013-07-14 14:20 - 2012-09-06 20:09 - 00000000 ____D C:\Users\Teske\AppData\Local\Adobe 2013-07-14 14:19 - 2012-09-06 19:07 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-07-14 14:19 - 2012-09-06 19:07 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-08-02 16:19 ==================== End Of Log ============================ Ich hoffe alle Infos soweit zusammengetragen zu haben. Wenn noch etwas fehlt, reiche ich das gerne nach. Danke schon mal im Voraus. Seit den ersten Schritten fährt der Rechner wieder vernünftig hoch - er hat mir nur eine der gelöschten Dateien (hovphsiiqlhcvjhebpl.bfg) angemeckert. |
| Themen zu Interpol Trojaner - Rechner gesperrt - wie bekomme ich den weg ? |
| farbar, farbar recovery scan tool, helper.exe, internet browser, internet explorer, java/jogek.ctw.1, java/jogek.ctw.5, java/jogek.ctw.6, java/jogek.ctw.7, java/jogek.ctw.8, java/jogek.ctw.9, java/lamar.ygs.11, java/lamar.ygs.14, java/lamar.ygs.15, lws.exe, plug-in, registrierungsdatenbank, registry key, spyhunter, spyhunter entfernen, tr/crypt.epack.9212, trojan.agent, trojan.agent.ed, trojan.winlock.rre, wqjmjzxw/cffxnm2.class, wqjmjzxw/euasavnxl.class, wqjmjzxw/gxlfou.class, wqjmjzxw/qwe.class, wqjmjzxw/vojbpdhbz.class, wqjmjzxw/vojbpdhbz2.class |
Baum-Darstellung