GVU Trojaner - abgesicherter Modus funktioniert nicht - Windows7 32bit - Daten sichern

jk71-a · 26.08.2013, 09:39

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=8fd3480e323f554e915fc9eb31a65504
# engine=14899
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-26 08:26:23
# local_time=2013-08-26 10:26:23 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5892 16777213 88 94 135116 28341508 0 0
# scanned=339208
# found=2
# cleaned=0
# scan_time=7565
sh=EECA84F04225612BDF51045DB216716D1E6A9715 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\Nadine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7CIHAFV\cpvload[1].htm"
sh=4A20E1055D39C301A68FD784CDB713EB2177C838 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.PJI trojan" ac=I fn="C:\Users\Nadine\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\74a69096-4d01b7ff"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.72  
 Windows 7 Service Pack 1 x86 (UAC is disabled!)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
Microsoft Security Essentials   
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java(TM) 6 Update 35  
 Java version out of Date! 
 Adobe Flash Player 	11.5.502.110  
 Adobe Reader 10.1.7 Adobe Reader out of Date!  
 Mozilla Firefox (23.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-08-2013
Ran by Nadine (administrator) on 26-08-2013 10:43:03
Running from C:\Users\Nadine\Downloads
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SafeNet Inc.) C:\Windows\system32\hasplms.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Entriq, Inc.) C:\Program Files\maxdome\DCBin\DCService.exe
(X10) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
() C:\Program Files\maxdome\DCBin\DCTrayApp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MpCmdRun.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2010-09-08] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421160 2010-09-24] (Apple Inc.)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-06-20] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [702024 2012-12-13] (Cisco Systems, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\maxdome Download Manager.lnk
ShortcutTarget: maxdome Download Manager.lnk -> C:\Program Files\maxdome\DCBin\DCTrayApp.exe ()

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {C5E997AC-B9AF-4DD4-BE30-5F7ADC5B0090} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: msdaipp - No CLSID Value - 
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 172.16.42.1
Tcpip\..\Interfaces\{CBB0FF2F-4AE3-4CB4-BB33-C05B07EA4D9D}: [NameServer]10.156.33.53,129.187.5.1

FireFox:
========
FF ProfilePath: C:\Users\Nadine\AppData\Roaming\Mozilla\Firefox\Profiles\1w570ita.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_35 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Nadine\AppData\Roaming\Mozilla\Firefox\Profiles\1w570ita.default\searchplugins\amazon.xml
FF Extension: No Name - C:\Users\Nadine\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\Nadine\AppData\Roaming\Mozilla\Firefox\Profiles\1w570ita.default\Extensions\complitly_0.sqlite
FF Extension: No Name - C:\Users\Nadine\AppData\Roaming\Mozilla\Firefox\Profiles\1w570ita.default\Extensions\WTB_GLOBAL.sqlite
FF Extension: No Name - C:\Users\Nadine\AppData\Roaming\Mozilla\Firefox\Profiles\1w570ita.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========================== Services (Whitelisted) =================

R2 hasplms; C:\Windows\system32\hasplms.exe [3750400 2009-12-16] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-06-20] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-06-20] (Microsoft Corporation)
R2 Prosieben; C:\Program Files\maxdome\DCBin\DCService.exe [77032 2009-05-01] (Entriq, Inc.)
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [544840 2012-12-13] (Cisco Systems, Inc.)
R2 x10nets; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [20480 2001-11-12] (X10)

==================== Drivers (Whitelisted) ====================

S3 acsock; C:\Windows\System32\DRIVERS\acsock.sys [92112 2012-12-13] (Cisco Systems, Inc.)
R2 aksfridge; C:\Windows\system32\drivers\aksfridge.sys [356864 2009-08-20] (Aladdin Knowledge Systems Ltd.)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [588800 2009-12-09] (SafeNet Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
S3 TrdCap; C:\Windows\System32\DRIVERS\TrdCap.sys [1554472 2010-06-09] (Trident Microsystems, Inc.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13976 2006-11-17] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-26 10:36 - 2013-08-26 10:36 - 00891115 _____ C:\Users\Nadine\Desktop\SecurityCheck.exe
2013-08-25 14:11 - 2013-08-25 14:11 - 00001349 _____ C:\Users\Nadine\Desktop\JRT.txt
2013-08-25 14:09 - 2013-08-25 14:09 - 00000000 ____D C:\Windows\ERUNT
2013-08-25 13:53 - 2013-08-25 13:54 - 00000000 ____D C:\AdwCleaner
2013-08-25 11:27 - 2013-08-25 11:27 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Users\Nadine\AppData\Roaming\Malwarebytes
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-25 11:27 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-24 20:30 - 2013-08-25 13:11 - 00000000 ____D C:\Users\Nadine\Desktop\JCB-paper-newest
2013-08-24 14:40 - 2013-08-24 14:40 - 00000000 ____D C:\FRST
2013-08-23 22:33 - 2013-08-23 22:33 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-23 22:33 - 2013-08-23 22:33 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-21 17:12 - 2013-08-21 17:12 - 00000000 ____D C:\Program Files\Common Files\PDF Architect
2013-08-21 17:04 - 2013-08-22 18:37 - 00000000 ____D C:\Users\Nadine\Desktop\JCB-paper-neu
2013-08-20 03:05 - 2013-08-20 03:06 - 00000000 ____D C:\Users\Nadine\AppData\Roaming\PDF Architect
2013-08-20 03:05 - 2013-08-20 03:05 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.4352.dll
2013-08-20 03:04 - 2013-08-20 03:05 - 00000000 ____D C:\Program Files\PDFCreator
2013-08-20 03:04 - 2013-08-20 03:04 - 00000993 _____ C:\Users\Public\Desktop\PDFCreator.lnk
2013-08-20 03:04 - 2013-04-09 15:13 - 00095416 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2013-08-20 03:04 - 2012-05-05 11:54 - 00662288 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCT2.OCX
2013-08-20 03:04 - 2012-05-05 11:54 - 00137000 _____ (Microsoft Corporation) C:\Windows\system32\MSMAPI32.OCX
2013-08-20 03:04 - 2012-05-05 11:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\MSMPIDE.DLL
2013-08-20 03:04 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\system32\VB6DE.DLL
2013-08-20 03:04 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\MSCMCDE.DLL
2013-08-20 03:04 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\MSCC2DE.DLL
2013-08-20 02:56 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-08-19 23:52 - 2013-08-20 03:19 - 00000000 ____D C:\Users\Nadine\Desktop\JCB-paper
2013-08-19 20:20 - 2013-08-19 20:35 - 00000000 ____D C:\Users\Nadine\Desktop\Figure 1
2013-08-18 21:48 - 2013-08-18 21:48 - 00231188 _____ C:\Users\Nadine\Desktop\patients.pptx
2013-08-17 12:22 - 2013-08-23 22:32 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-14 10:32 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 10:32 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 10:32 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 10:32 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 10:32 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 10:32 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 10:32 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 10:32 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 10:32 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 10:32 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 10:32 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 10:32 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 10:32 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 10:31 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 10:31 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 10:31 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 09:58 - 2013-08-18 21:41 - 00000000 ____D C:\Users\Nadine\Desktop\Journal of Cell Biology
2013-08-14 00:52 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 00:52 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 00:52 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 00:52 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 00:52 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 00:52 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 00:52 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 00:52 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 00:52 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 00:52 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 00:52 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 00:52 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-11 16:27 - 2013-08-11 16:54 - 00000000 ____D C:\Users\Nadine\Desktop\Scratch-assay- representatives
2013-08-05 17:09 - 2013-08-09 23:30 - 00000000 ____D C:\Users\Nadine\Desktop\Paper Mucosal Immunology
2013-08-01 20:17 - 2013-08-01 20:23 - 00000000 ____D C:\Users\Nadine\Desktop\Basischarakterisierung CHOP
2013-08-01 20:15 - 2013-08-01 20:16 - 00000000 ____D C:\Users\Nadine\Desktop\NW67_continie_proliferationsraten_stabile zelllinien-wst rate

==================== One Month Modified Files and Folders =======

2013-08-26 10:42 - 2013-08-26 10:42 - 01070979 _____ (Farbar) C:\Users\Nadine\Downloads\FRST.exe
2013-08-26 10:36 - 2013-08-26 10:36 - 00891115 _____ C:\Users\Nadine\Desktop\SecurityCheck.exe
2013-08-26 10:25 - 2010-09-04 11:30 - 01537402 _____ C:\Windows\WindowsUpdate.log
2013-08-26 09:51 - 2013-06-13 08:53 - 00000000 ____D C:\Users\Nadine\Desktop\Doktorarbeit_August-24
2013-08-26 09:44 - 2013-06-25 14:12 - 00781310 _____ C:\Users\Nadine\Desktop\Einleitung Copy.enl
2013-08-26 08:16 - 2009-07-14 06:34 - 00013760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-26 08:16 - 2009-07-14 06:34 - 00013760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-26 08:15 - 2009-07-14 06:39 - 00119112 _____ C:\Windows\setupact.log
2013-08-26 08:09 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-25 19:18 - 2013-01-09 00:17 - 00000000 ____D C:\Users\Nadine\Desktop\Lebensläufe
2013-08-25 16:31 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-25 14:11 - 2013-08-25 14:11 - 00001349 _____ C:\Users\Nadine\Desktop\JRT.txt
2013-08-25 14:09 - 2013-08-25 14:09 - 00000000 ____D C:\Windows\ERUNT
2013-08-25 13:54 - 2013-08-25 13:53 - 00000000 ____D C:\AdwCleaner
2013-08-25 13:47 - 2011-02-05 20:57 - 00017226 _____ C:\Windows\PFRO.log
2013-08-25 13:11 - 2013-08-24 20:30 - 00000000 ____D C:\Users\Nadine\Desktop\JCB-paper-newest
2013-08-25 11:27 - 2013-08-25 11:27 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Users\Nadine\AppData\Roaming\Malwarebytes
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-24 20:56 - 2012-05-21 01:28 - 00002155 _____ C:\Windows\epplauncher.mif
2013-08-24 20:54 - 2011-11-08 13:24 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-08-24 20:46 - 2011-11-08 11:45 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-24 20:46 - 2009-07-14 04:04 - 00000478 _____ C:\Windows\win.ini
2013-08-24 20:31 - 2010-09-04 13:10 - 00000000 ____D C:\Users\Nadine\AppData\Roaming\Skype
2013-08-24 14:40 - 2013-08-24 14:40 - 00000000 ____D C:\FRST
2013-08-23 22:33 - 2013-08-23 22:33 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-23 22:33 - 2013-08-23 22:33 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-23 22:32 - 2013-08-17 12:22 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-22 18:37 - 2013-08-21 17:04 - 00000000 ____D C:\Users\Nadine\Desktop\JCB-paper-neu
2013-08-21 17:12 - 2013-08-21 17:12 - 00000000 ____D C:\Program Files\Common Files\PDF Architect
2013-08-20 03:19 - 2013-08-19 23:52 - 00000000 ____D C:\Users\Nadine\Desktop\JCB-paper
2013-08-20 03:06 - 2013-08-20 03:05 - 00000000 ____D C:\Users\Nadine\AppData\Roaming\PDF Architect
2013-08-20 03:05 - 2013-08-20 03:05 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.4352.dll
2013-08-20 03:05 - 2013-08-20 03:04 - 00000000 ____D C:\Program Files\PDFCreator
2013-08-20 03:05 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-08-20 03:04 - 2013-08-20 03:04 - 00000993 _____ C:\Users\Public\Desktop\PDFCreator.lnk
2013-08-19 20:35 - 2013-08-19 20:20 - 00000000 ____D C:\Users\Nadine\Desktop\Figure 1
2013-08-19 20:35 - 2012-11-27 20:34 - 00000218 _____ C:\Windows\system32\kfgrbtv.tgz
2013-08-19 20:35 - 2012-11-27 20:34 - 00000114 _____ C:\Windows\system32\prsgrc.tgz
2013-08-19 20:35 - 2012-11-27 20:34 - 00000086 _____ C:\Windows\system32\ssprs.tgz
2013-08-19 20:35 - 2012-07-31 15:12 - 00000204 _____ C:\Windows\system32\kfgrbtv.dll
2013-08-19 20:35 - 2012-07-31 15:12 - 00000100 _____ C:\Windows\system32\prsgrc.dll
2013-08-18 21:55 - 2012-01-22 19:56 - 00000000 ____D C:\Users\Nadine\progress reports
2013-08-18 21:48 - 2013-08-18 21:48 - 00231188 _____ C:\Users\Nadine\Desktop\patients.pptx
2013-08-18 21:41 - 2013-08-14 09:58 - 00000000 ____D C:\Users\Nadine\Desktop\Journal of Cell Biology
2013-08-16 15:23 - 2013-03-26 20:23 - 00000000 ____D C:\Users\Nadine\Desktop\alle DSS statistics tissue plus cell infiltration
2013-08-16 15:18 - 2013-03-30 15:01 - 00000000 ____D C:\Users\Nadine\Desktop\paper discussion
2013-08-15 10:04 - 2012-09-10 15:51 - 00000000 ____D C:\Users\Nadine\Desktop\paper einleitung
2013-08-14 22:01 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-08-14 19:49 - 2013-07-11 19:00 - 00000000 ____D C:\Users\Nadine\Desktop\Paper Cell Development
2013-08-14 10:39 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-14 10:38 - 2013-07-25 00:09 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 10:36 - 2011-11-08 12:37 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-13 22:56 - 2012-09-09 22:24 - 00000000 ____D C:\Users\Public\Documents\maxdome
2013-08-13 22:56 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-13 08:38 - 2013-08-20 02:56 - 00032328 _____ C:\Windows\Launcher.exe
2013-08-11 19:52 - 2012-01-22 19:51 - 00000000 ____D C:\Users\Nadine\Western Blots
2013-08-11 16:54 - 2013-08-11 16:27 - 00000000 ____D C:\Users\Nadine\Desktop\Scratch-assay- representatives
2013-08-09 23:30 - 2013-08-05 17:09 - 00000000 ____D C:\Users\Nadine\Desktop\Paper Mucosal Immunology
2013-08-01 20:23 - 2013-08-01 20:17 - 00000000 ____D C:\Users\Nadine\Desktop\Basischarakterisierung CHOP
2013-08-01 20:16 - 2013-08-01 20:15 - 00000000 ____D C:\Users\Nadine\Desktop\NW67_continie_proliferationsraten_stabile zelllinien-wst rate
2013-07-31 21:24 - 2012-01-22 19:51 - 00000000 ____D C:\Users\Nadine\Mikroskop
2013-07-31 21:16 - 2012-01-22 19:54 - 00000000 ____D C:\Users\Nadine\Volocity libraries
2013-07-29 22:30 - 2010-12-13 23:08 - 00000000 ____D C:\Users\Nadine\AppData\Local\Microsoft Games
2013-07-29 19:45 - 2013-05-30 20:01 - 00000000 ____D C:\Users\Nadine\Desktop\phd_data_graphpad-doktorarbeit
2013-07-28 22:28 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV

Files to move or delete:
====================
C:\Users\Nadine\Firefox_Setup_3.6.8.exe
C:\Users\Nadine\AppData\Local\Temp\ApnStub.exe
C:\Users\Nadine\AppData\Local\Temp\apptorun.exe
C:\Users\Nadine\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Nadine\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Nadine\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Nadine\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Nadine\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Nadine\AppData\Local\Temp\Quarantine.exe
C:\Users\Nadine\AppData\Local\Temp\Risweb32.exe
C:\Users\Nadine\AppData\Local\Temp\setup.exe
C:\Users\Nadine\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Nadine\AppData\Local\Temp\{93C46EA7-D02D-4461-96A5-60E6586CC176}\_Setup.dll
C:\Users\Nadine\AppData\Local\Temp\{0382A2B0-4B46-4E8D-9154-A0DBDEB11BA8}\InstallFlashPlayer.exe
C:\Users\Nadine\AppData\Local\Temp\SDIAG_6c2fc5e3-08ff-4462-8224-fa4f02e85401\DiagPackage.dll
C:\Users\Nadine\AppData\Local\Temp\SDIAG_12a06e36-1eea-4de0-90a6-52d4ef161a81\DiagPackage.dll
C:\Users\Nadine\AppData\Local\Temp\RarSFX0\SecurityCheck\Objlist.exe
C:\Users\Nadine\AppData\Local\Temp\RarSFX0\SecurityCheck\runprocesses.exe
C:\Users\Nadine\AppData\Local\Temp\RarSFX0\SecurityCheck\uninstalllist.exe
C:\Users\Nadine\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\cmdinfo.exe
C:\Users\Nadine\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\nircmdc.exe
C:\Users\Nadine\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\sed.exe
C:\Users\Nadine\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\swreg.exe
C:\Users\Nadine\AppData\Local\Temp\nswDF2A.tmp\System.dll
C:\Users\Nadine\AppData\Local\Temp\nswDF2A.tmp\UserInfo.dll
C:\Users\Nadine\AppData\Local\Temp\nsm909.tmp\registry.dll
C:\Users\Nadine\AppData\Local\Temp\nsm8F29.tmp\brknctrlr.exe
C:\Users\Nadine\AppData\Local\Temp\nsm8F29.tmp\registry.dll
C:\Users\Nadine\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Users\Nadine\AppData\Local\Temp\is-PEVEQ.tmp\cinshlpr.dll
C:\Users\Nadine\AppData\Local\Temp\is-PEVEQ.tmp\InstallHelper.dll
C:\Users\Nadine\AppData\Local\Temp\is-1U0DD.tmp\Interop.IWshRuntimeLibrary.dll
C:\Users\Nadine\AppData\Local\Temp\is-1U0DD.tmp\System.Data.SQLite.dll
C:\Users\Nadine\AppData\Local\Temp\ED5B.tmp\vpndownloader.exe
C:\Users\Nadine\AppData\Local\Temp\E956.dir\InstallFlashPlayer.exe
C:\Users\Nadine\AppData\Local\Temp\CF03.tmp\vpndownloader.exe
C:\Users\Nadine\AppData\Local\Temp\C477.tmp\vpndownloader.exe
C:\Users\Nadine\AppData\Local\Temp\68F0.dir\InstallFlashPlayer.exe
C:\Users\Nadine\AppData\Local\Temp\4E01.dir\InstallFlashPlayer.exe
C:\Users\Nadine\AppData\Local\Temp\444.tmp\vpndownloader.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-12 00:13

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Keine Probleme mehr! Dank dir!!!

GVU Trojaner - abgesicherter Modus funktioniert nicht - Windows7 32bit - Daten sichern

Log-Analyse und Auswertung: GVU Trojaner - abgesicherter Modus funktioniert nicht - Windows7 32bit - Daten sichern

GVU Trojaner - abgesicherter Modus funktioniert nicht - Windows7 32bit - Daten sichern

Ähnliche Themen: GVU Trojaner - abgesicherter Modus funktioniert nicht - Windows7 32bit - Daten sichern