| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: ungewöhnlicher DatentransferWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
17.09.2013, 13:12
| #1 |
| /// the machine /// TB-Ausbilder    |  ungewöhnlicher DatentransferESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.09.2013, 06:24
| #2 | |
 | ungewöhnlicher DatentransferCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ec3e6988eebefd419ba5aa43a7f8d092
# engine=15165
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-17 09:54:14
# local_time=2013-09-17 11:54:14 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1285 16777214 100 100 969164 75778804 0 0
# scanned=398893
# found=0
# cleaned=0
# scan_time=15075
Code:
ATTFilter Results of screen317's Security Check version 0.99.73 Windows XP Service Pack 3 x86 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Internet Security Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` WinPatrol SpywareBlaster 5.0 Secunia PSI (3.0.0.6005) Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Java 7 Update 25 Adobe Flash Player 11.8.800.168 Adobe Reader 10.1.8 Adobe Reader out of Date! Mozilla Firefox (23.0) Mozilla Thunderbird (17.0.8) ````````Process Check: objlist.exe by Laurent```````` WinPatrol winpatrol.exe Kaspersky Lab Kaspersky Internet Security 2012 avp.exe BillP Studios WinPatrol winpatrol.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-09-2013 03
Ran by ich (administrator) on XXX on 18-09-2013 19:36:12
Running from C:\Dokumente und Einstellungen\ich\Eigene Dateien\Downloads
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Creative Technology Ltd.) C:\Programme\Creative\SBLive\AudioHQ\AHQTB.EXE
(Creative Technology Ltd) C:\WINDOWS\system32\CTHELPER.EXE
(Logitech Inc.) C:\Programme\Logitech\iTouch\iTouch.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
() C:\Programme\Unlocker\UnlockerAssistant.exe
(BillP Studios) C:\Programme\BillP Studios\WinPatrol\winpatrol.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Secunia) C:\Programme\Secunia\PSI\psi_tray.exe
(Logitech Inc.) C:\Programme\Logitech\MouseWare\system\em_exec.exe
(Creative Technology Ltd.) C:\WINDOWS\system32\devldr32.exe
(Apache Software Foundation) e:\xampp\apache\bin\httpd.exe
(AVM Berlin) C:\Programme\avmwlanstick\WlanNetService.exe
(FileZilla Project) e:\xampp\filezillaftp\filezillaserver.exe
(Intel Corporation) C:\WINDOWS\system32\IProsetMonitor.exe
(Oracle Corporation) C:\Programme\Java\jre7\bin\jqs.exe
() e:\xampp\mysql\bin\mysqld.exe
(Nero AG) C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
(Secunia) C:\Programme\Secunia\PSI\PSIA.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Apache Software Foundation) E:\xampp\apache\bin\httpd.exe
(Secunia) C:\Programme\Secunia\PSI\sua.exe
(Kaspersky Lab ZAO) C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Kaspersky Lab ZAO) C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Opera Software) C:\Programme\Opera\opera.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDCPL] - C:\Windows\RTHDCPL.EXE [19576424 2010-09-14] (Realtek Semiconductor Corp.)
HKLM\...\Run: [AVMWlanClient] - C:\Programme\avmwlanstick\wlangui.exe [1544192 2006-07-31] (AVM Berlin)
HKLM\...\Run: [NeroFilterCheck] - C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [NBKeyScan] - C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [1828136 2007-09-10] (Nero AG)
HKLM\...\Run: [AudioHQ] - C:\Programme\Creative\SBLive\AudioHQ\AHQTB.EXE [191488 1998-07-16] (Creative Technology Ltd.)
HKLM\...\Run: [WINDVDPatch] - C:\Windows\system32\CTHELPER.EXE [24576 2002-07-02] (Creative Technology Ltd)
HKLM\...\Run: [UpdReg] - C:\WINDOWS\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM\...\Run: [Jet Detection] - C:\Programme\Creative\SBLive\PROGRAM\ADGJDet.exe [28672 2001-11-29] ()
HKLM\...\Run: [DevconDefaultDB] - C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS
HKLM\...\Run: [zBrowser Launcher] - C:\Programme\Logitech\iTouch\iTouch.exe [892928 2004-03-18] (Logitech Inc.)
HKLM\...\Run: [Logitech Utility] - C:\Windows\Logi_MwX.Exe [19968 2003-06-30] (Logitech Inc.)
HKLM\...\Run: [ElbyCheckAnyDVD] - C:\Programme\SlySoft\AnyDVD\ElbyCheck.exe [45056 2003-09-20] (Elaborate Bytes AG)
HKLM\...\Run: [CloneDVDElbyDelay] - C:\Programme\Elaborate Bytes\CloneDVD\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG)
HKLM\...\Run: [HotKeysCmds] - C:\WINDOWS\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [UnlockerAssistant] - C:\Programme\Unlocker\UnlockerAssistant.exe [17408 2010-07-04] ()
HKLM\...\Run: [AVP] - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
HKLM\...\Run: [PDFPrint] - C:\Programme\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM\...\Run: [WinPatrol] - C:\Programme\BillP Studios\WinPatrol\winpatrol.exe [422632 2013-04-17] (BillP Studios)
Winlogon\Notify\klogon: C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [SetDefaultMIDI] - C:\Windows\MIDIDef.exe [61440 2002-01-14] (Creative Technology Ltd)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKU\Administrator\...\RunOnce: [NeroHomeFirstStart] - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMFirstStart.exe [ 2007-08-21] (Nero AG)
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMFirstStart.exe [ 2007-08-21] (Nero AG)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Programme\Secunia\PSI\psi_tray.exe (Secunia)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKCU -&Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_11-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_11-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\ich\Anwendungsdaten\Mozilla\Firefox\Profiles\gaq2t0g5.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/DownloadManager,version=1.1 - C:\WINDOWS\ ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Programme\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/wpi,version=1.4 - C:\Programme\Microsoft\Web Platform Installer\\npwpidetector.dll (Microsoft Corp)
FF Plugin: @unity3d.com/UnityPlayer,version=1.0 - C:\Programme\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Programme\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101714.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Anti-Banner - C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak
FF Extension: Modul zur Link-Untersuchung - C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak
FF Extension: Java Console - C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF Extension: Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF HKLM\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
========================== Services (Whitelisted) =================
R2 Apache2.2; e:\xampp\apache\bin\httpd.exe [18432 2011-09-10] (Apache Software Foundation)
R2 AVM WLAN Connection Service; C:\Programme\avmwlanstick\WlanNetService.exe [370756 2006-07-31] (AVM Berlin)
R2 AVP; C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
R2 FileZilla Server; e:\xampp\filezillaftp\filezillaserver.exe [630272 2011-06-07] (FileZilla Project)
R2 Intel(R) PROSet Monitoring Service; C:\WINDOWS\system32\IProsetMonitor.exe [109728 2011-02-28] (Intel Corporation)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [117656 2013-08-25] (Mozilla Foundation)
S2 MsDepSvc; C:\Programme\IIS\Microsoft Web Deploy\MsDepSvc.exe [67400 2011-04-01] (Microsoft Corporation)
R2 mysql; e:\xampp\mysql\bin\my.ini [5396 2012-01-29] ()
R2 Nero BackItUp Scheduler 3; C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe [836904 2007-09-10] (Nero AG)
S3 NMIndexingService; C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe [382248 2007-08-21] (Nero AG)
R2 Secunia PSI Agent; C:\Programme\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Programme\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
R2 wlidsvc; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE [1529728 2009-08-18] (Microsoft Corporation)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
R2 JavaQuickStarterService; "C:\Programme\Java\jre7\bin\jqs.exe" -service -config "C:\Programme\Java\jre7\lib\deploy\jqs\jqs.conf"
==================== Drivers (Whitelisted) ====================
S3 Ambfilt; C:\Windows\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [22912 2003-09-29] (SlySoft, Inc.)
S3 cpudrv; C:\Programme\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 ctljystk; C:\Windows\System32\DRIVERS\ctljystk.sys [3712 2001-08-17] (Creative Technology Ltd.)
R2 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [9728 2003-09-15] (Elaborate Bytes AG)
R3 ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [3840 2003-03-28] (Elaborate Bytes)
R3 emu10k; C:\Windows\System32\drivers\emu10k1m.sys [283904 2001-08-17] (Creative Technology Ltd.)
R3 emu10k1; C:\Windows\System32\drivers\ctlfacem.sys [6912 2001-08-17] (Creative Technology Ltd.)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-07-31] (AVM GmbH)
R3 itchfltr; C:\Windows\System32\DRIVERS\itchfltr.sys [12953 2004-03-10] (Logitech, Inc.)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [133208 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11352 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [565552 2011-04-20] (Kaspersky Lab)
R3 klim5; C:\Windows\System32\DRIVERS\klim5.sys [34608 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [19472 2009-11-02] (Kaspersky Lab)
R3 L8042pr2; C:\Windows\System32\DRIVERS\L8042pr2.Sys [53870 2003-06-30] (Logitech, Inc.)
S3 LHidUsb; C:\Windows\System32\Drivers\LHidUsb.Sys [37887 2004-03-03] (Logitech, Inc.)
S3 Monfilt; C:\Windows\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-02-07] (Secunia)
R3 sfman; C:\Windows\System32\drivers\sfmanm.sys [36480 2001-08-17] (Creative Technology Ltd.)
R1 vmm; C:\WINDOWS\system32\Drivers\vmm.sys [229208 2011-08-26] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\ich\LOKALE~1\Temp\catchme.sys [x]
S4 IntelIde; No ImagePath
U4 L8042PRT;
S1 lkbdhlpr; System32\Drivers\lkbdhlpr.sys [x]
U1 sermouse;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-17 07:57 - 2013-09-17 07:57 - 00000579 _____ C:\Dokumente und Einstellungen\ich\Desktop\JRT.txt
2013-09-15 21:04 - 2013-09-15 21:04 - 00014056 _____ C:\ComboFix.txt
2013-09-15 20:44 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-09-15 20:44 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-09-15 20:44 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-09-15 20:44 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-09-15 20:44 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-09-15 20:44 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-09-15 20:44 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-09-15 20:44 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-09-15 20:44 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-09-15 20:43 - 2013-09-15 21:04 - 00000000 ____D C:\Qoobox
2013-09-14 11:57 - 2013-09-14 11:57 - 00000000 ____D C:\FRST
2013-09-13 21:28 - 2013-09-13 21:28 - 00000000 _____ C:\Dokumente und Einstellungen\ich\defogger_reenable
2013-09-12 20:48 - 2013-09-17 08:02 - 00000000 ____D C:\AdwCleaner
2013-09-12 20:07 - 2013-09-12 20:07 - 00013573 _____ C:\WINDOWS\KB2870699-IE8.log
2013-09-12 20:06 - 2013-09-12 20:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-12 20:06 - 2013-09-12 20:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-12 20:06 - 2013-09-12 20:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-12 18:56 - 2013-09-12 20:06 - 00012811 _____ C:\WINDOWS\KB2876315.log
2013-09-12 18:56 - 2013-09-12 20:06 - 00011841 _____ C:\WINDOWS\KB2876217.log
2013-09-12 18:55 - 2013-09-12 20:06 - 00011533 _____ C:\WINDOWS\KB2864063.log
2013-09-03 20:14 - 2013-09-18 01:48 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-08-27 20:00 - 2013-08-27 20:00 - 00004820 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-27 20:00 - 2013-08-27 20:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
==================== One Month Modified Files and Folders =======
2013-09-18 19:24 - 2008-10-08 22:01 - 00097280 _____ C:\Dokumente und Einstellungen\ich\Eigene Dateien\X-Mas 2008.xls
2013-09-18 19:15 - 2011-06-02 13:24 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-09-18 19:15 - 2011-06-02 13:24 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-09-18 19:15 - 2011-05-18 21:21 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Eigene Dateien\My PSP Files
2013-09-18 19:15 - 2011-05-16 12:33 - 01054985 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-18 19:05 - 2012-04-01 10:06 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-18 18:51 - 2011-05-16 13:51 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2013-09-18 18:42 - 2011-05-16 12:55 - 00000000 ___RD C:\Programme
2013-09-18 18:39 - 2011-05-16 13:22 - 00000000 ___RD C:\Dokumente und Einstellungen\ich\Startmenü\Programme
2013-09-18 18:27 - 2012-05-06 10:08 - 00000000 ____D C:\Programme\Mozilla Maintenance Service
2013-09-18 18:27 - 2011-05-20 20:13 - 00000051 _____ C:\WINDOWS\iTouch.ini
2013-09-18 18:27 - 2011-05-16 13:17 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-09-18 06:01 - 2011-05-16 13:17 - 00032376 _____ C:\WINDOWS\SchedLgU.Txt
2013-09-18 06:00 - 2011-05-16 13:22 - 00000190 ___SH C:\Dokumente und Einstellungen\ich\ntuser.ini
2013-09-18 01:48 - 2013-09-03 20:14 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-09-18 01:48 - 2013-08-09 21:44 - 00000696 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
2013-09-18 01:48 - 2011-05-17 15:14 - 00000702 _____ C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
2013-09-17 08:02 - 2013-09-12 20:48 - 00000000 ____D C:\AdwCleaner
2013-09-17 07:57 - 2013-09-17 07:57 - 00000579 _____ C:\Dokumente und Einstellungen\ich\Desktop\JRT.txt
2013-09-17 07:37 - 2011-05-18 21:02 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Eigene Dateien\5_Internet
2013-09-17 07:30 - 2011-10-13 22:40 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2592799$
2013-09-15 21:04 - 2013-09-15 21:04 - 00014056 _____ C:\ComboFix.txt
2013-09-15 21:04 - 2013-09-15 20:43 - 00000000 ____D C:\Qoobox
2013-09-15 21:00 - 2004-08-04 14:00 - 00000227 _____ C:\WINDOWS\system.ini
2013-09-15 20:59 - 2011-05-16 13:22 - 00000000 ____D C:\Dokumente und Einstellungen\ich
2013-09-15 20:42 - 2007-02-15 20:38 - 20209152 _____ C:\Dokumente und Einstellungen\ich\Eigene Dateien\Medien-Liste.xls
2013-09-14 12:22 - 2011-05-30 19:13 - 00000069 _____ C:\WINDOWS\NeroDigital.ini
2013-09-14 11:57 - 2013-09-14 11:57 - 00000000 ____D C:\FRST
2013-09-13 23:27 - 2011-05-18 20:52 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Eigene Dateien\8_Video
2013-09-13 23:06 - 2011-05-18 19:11 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Eigene Dateien\3_Bands
2013-09-13 23:03 - 2011-06-02 13:22 - 00382766 _____ C:\WINDOWS\setupapi.log
2013-09-13 21:28 - 2013-09-13 21:28 - 00000000 _____ C:\Dokumente und Einstellungen\ich\defogger_reenable
2013-09-13 21:28 - 2011-05-17 15:19 - 00000000 ____D C:\Programme\Opera
2013-09-13 21:06 - 2012-04-01 10:06 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-13 21:06 - 2011-05-18 19:32 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-09-13 20:20 - 2012-01-15 00:47 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\NPE
2013-09-13 20:11 - 2011-05-16 13:52 - 00000327 __RSH C:\boot.ini
2013-09-12 20:54 - 2011-05-16 14:27 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB961501$
2013-09-12 20:54 - 2011-05-16 12:54 - 00481928 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-12 20:14 - 2013-04-27 20:43 - 00000000 ____D C:\Programme\SpywareBlaster
2013-09-12 20:07 - 2013-09-12 20:07 - 00013573 _____ C:\WINDOWS\KB2870699-IE8.log
2013-09-12 20:07 - 2011-06-13 11:08 - 00061960 _____ C:\WINDOWS\updspapi.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00844196 _____ C:\WINDOWS\iis6.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00782279 _____ C:\WINDOWS\FaxSetup.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00372584 _____ C:\WINDOWS\ocgen.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00355466 _____ C:\WINDOWS\tsoc.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00258335 _____ C:\WINDOWS\comsetup.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00238832 _____ C:\WINDOWS\msmqinst.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00156262 _____ C:\WINDOWS\ntdtcsetup.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00136458 _____ C:\WINDOWS\netfxocm.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00053550 _____ C:\WINDOWS\MedCtrOC.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00042750 _____ C:\WINDOWS\ocmsn.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00039186 _____ C:\WINDOWS\tabletoc.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00038934 _____ C:\WINDOWS\msgsocm.log
2013-09-12 20:07 - 2011-06-13 11:07 - 00001374 _____ C:\WINDOWS\imsins.log
2013-09-12 20:07 - 2011-05-16 14:36 - 00000000 ____D C:\WINDOWS\ie8updates
2013-09-12 20:06 - 2013-09-12 20:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-12 20:06 - 2013-09-12 20:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-12 20:06 - 2013-09-12 20:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-12 20:06 - 2013-09-12 18:56 - 00012811 _____ C:\WINDOWS\KB2876315.log
2013-09-12 20:06 - 2013-09-12 18:56 - 00011841 _____ C:\WINDOWS\KB2876217.log
2013-09-12 20:06 - 2013-09-12 18:55 - 00011533 _____ C:\WINDOWS\KB2864063.log
2013-09-12 20:06 - 2011-06-13 11:07 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-09-12 20:04 - 2013-07-11 00:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-09-12 20:00 - 2011-05-16 14:33 - 76725432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-09-12 18:59 - 2011-07-03 20:21 - 00002347 _____ C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader X.lnk
2013-09-12 18:59 - 2011-05-16 12:54 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2013-09-12 18:44 - 2004-08-04 14:00 - 00012598 _____ C:\WINDOWS\system32\wpa.dbl
2013-09-10 19:52 - 2011-05-18 19:05 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Eigene Dateien\Eigene Webs
2013-09-09 19:39 - 2011-05-18 21:23 - 00001004 ___SH C:\WINDOWS\system32\KGyGaAvL.sys
2013-09-09 19:37 - 2011-05-16 13:22 - 00000000 ___RD C:\Dokumente und Einstellungen\ich\Eigene Dateien\Eigene Bilder
2013-09-07 12:58 - 2011-05-22 17:09 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
2013-09-05 20:23 - 2012-07-14 16:41 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Anwendungsdaten\FileZilla
2013-08-27 20:00 - 2013-08-27 20:00 - 00004820 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-27 20:00 - 2013-08-27 20:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-26 19:53 - 2011-05-18 21:01 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Eigene Dateien\4_Musik
2013-08-25 17:43 - 2011-05-18 18:33 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Anwendungsdaten\Dropbox
2013-08-25 17:43 - 2011-05-18 18:29 - 00000000 ___RD C:\Dokumente und Einstellungen\ich\Eigene Dateien\Dropbox
2013-08-25 17:25 - 2011-05-18 18:35 - 00001014 _____ C:\Dokumente und Einstellungen\ich\Desktop\Dropbox.lnk
2013-08-25 17:25 - 2011-05-18 18:34 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Startmenü\Programme\Dropbox
2013-08-24 21:29 - 2011-05-18 18:34 - 00178648 _____ C:\Dokumente und Einstellungen\ich\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2013-08-23 18:50 - 2012-12-29 14:17 - 00000000 ____D C:\Dokumente und Einstellungen\ich\Anwendungsdaten\vlc
2013-08-20 18:38 - 2013-04-20 13:14 - 00000691 _____ C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2008-04-14 07:52] - [2008-04-14 07:52] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e
C:\Windows\System32\winlogon.exe
[2008-04-14 07:53] - [2008-04-14 07:53] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a
C:\Windows\System32\svchost.exe
[2008-04-14 07:53] - [2008-04-14 07:53] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366
C:\Windows\System32\services.exe
[2008-04-14 07:53] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc
C:\Windows\System32\User32.dll
[2008-04-14 07:52] - [2008-04-14 07:52] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd
C:\Windows\System32\userinit.exe
[2008-04-14 07:53] - [2008-04-14 07:53] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106
C:\Windows\System32\Drivers\volsnap.sys
[2008-04-14 07:22] - [2008-04-14 07:22] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d
==================== End Of Log ============================
Zitat:
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.18.10 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 ich :: XXX [Administrator] 18.09.2013 19:42:29 mbam-log-2013-09-18 (19-42-29).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 612967 Laufzeit: 9 Stunde(n), 19 Minute(n), 15 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
| Themen zu ungewöhnlicher Datentransfer |
| adblock, adobe, adware.clicker, bho, converter, einstellungen, flash player, internet browser, msiinstaller, nodrives, pup.optional.opencandy, pup.optional.softonic, registry, secunia psi, security, trojan.agent.cpl, udp |
Hybrid-Darstellung
