| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner "TR/Crypt.ZPACK.Gen8" in C:\Users\johanna\AppData\Roaming\skype.dat via Avira gefundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
19.09.2013, 19:56
| #1 |
| |  Trojaner "TR/Crypt.ZPACK.Gen8" in C:\Users\johanna\AppData\Roaming\skype.dat via Avira gefunden ach mist .... schau mal das logfile vom Eset  Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7c5cf60a530a5e4e827c0760186bc11f
# engine=15189
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-19 05:55:11
# local_time=2013-09-19 07:55:11 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 5387 245036601 0 0
# compatibility_mode=5122 16777214 0 13 92888884 107144733 0 0
# compatibility_mode=5893 16776573 100 94 84434 131244502 0 0
# scanned=127578
# found=1
# cleaned=0
# scan_time=4907
sh=F920B7B9348F35D55215B9BB6A7B43781346C9EF ft=1 fh=8c024e84164d15f3 vn="möglicherweise Variante von Win32/Grimkast.A Virus" ac=I fn="D:\Downloads\downloads\GAMES\Nfs4\CARMAN.EXE"
D:\Downloads\downloads\GAMES\Nfs4\CARMAN.EXE möglicherweise Variante von Win32/Grimkast.A Virus und hier security check Code:
ATTFilter Results of screen317's Security Check version 0.99.73 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.1.102.62 Adobe Reader 9 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe ESET ESET Online Scanner OnlineScannerApp.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-09-2013 03
Ran by johanna (administrator) on JOHANNA-PC on 19-09-2013 20:08:38
Running from D:\Desktop\Antivirenzeug
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(AMD) C:\windows\system32\atiesrxx.exe
(AMD) C:\windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Nitro PDF Software) C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe
() C:\windows\SYSTEM32\Rezip.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
() C:\Program Files\XSManager\WTGService.exe
(4G Systems GmbH & Co. KG) C:\windows\service4g.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(4G Systems GmbH & Co. KG) C:\Windows\starter4g.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Avira Operations GmbH & Co. KG) C:\program files\avira\antivir desktop\ipmGui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
(Google) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-01] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7744032 2009-09-29] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1541416 2009-07-15] (Synaptics Incorporated)
HKLM\...\Run: [UCam_Menu] - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [218408 2009-02-25] (CyberLink Corp.)
HKLM\...\Run: [starter4g] - C:\windows\starter4g.exe [160992 2010-07-08] (4G Systems GmbH & Co. KG)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-16] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-09-17] (Google Inc.)
HKCU\...\Policies\Explorer: [NoDrives] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
========================== Services (Whitelisted) =================
S2 0096401286719054mcinstcleanup; C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini [1216 2010-10-10] ()
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-03-28] (LSI Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-16] (Avira Operations GmbH & Co. KG)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Nitro\Reader 3\NitroPDFReaderDriverService3.exe [196624 2013-06-18] (Nitro PDF Software)
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] ()
R2 WTGService; C:\Program Files\XSManager\WTGService.exe [329168 2010-04-12] ()
R2 XS Stick Service; C:\windows\service4g.exe [145120 2010-07-08] (4G Systems GmbH & Co. KG)
R2 yksvc; C:\Windows\System32\yk62x86.dll [364544 2009-09-28] (Marvell)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-16] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-16] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-04] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [103424 2011-10-20] (Mobile Connector)
S3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
R1 SABI; C:\windows\system32\Drivers\SABI.sys [10752 2009-05-28] (SAMSUNG ELECTRONICS)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-11-14] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 VMC326; C:\Windows\System32\Drivers\VMC326.sys [237696 2009-08-10] (Vimicro Corporation)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\johanna\AppData\Local\Temp\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-19 18:28 - 2013-09-19 18:28 - 00000000 ____D C:\Program Files\ESET
2013-09-19 10:10 - 2013-09-19 18:25 - 98378485 _____ C:\windows\system32\洏Ū᭔]
2013-09-18 20:17 - 2013-09-18 20:17 - 00000000 ____D C:\windows\ERUNT
2013-09-18 19:27 - 2013-09-18 19:27 - 00000000 ____D C:\Users\johanna\AppData\Roaming\Malwarebytes
2013-09-18 19:27 - 2013-09-18 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-18 19:27 - 2013-09-18 19:27 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-18 19:27 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-18 14:16 - 2013-09-18 14:16 - 00009526 _____ C:\ComboFix.txt
2013-09-18 14:02 - 2013-09-18 14:17 - 00000000 ____D C:\Qoobox
2013-09-18 14:02 - 2013-09-18 14:14 - 00000000 ____D C:\windows\erdnt
2013-09-18 14:02 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-18 14:02 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-18 14:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-18 14:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-18 14:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-18 14:02 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-18 14:02 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-18 14:02 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-18 12:28 - 2013-09-18 12:28 - 00000000 ____D C:\FRST
2013-09-18 12:20 - 2013-09-18 12:22 - 00000636 _____ C:\windows\system32\defogger_disable.log
2013-09-18 12:20 - 2013-09-18 12:22 - 00000176 _____ C:\Users\johanna\defogger_reenable
2013-09-18 11:19 - 2013-09-18 19:45 - 00000000 ____D C:\AdwCleaner
2013-09-17 10:04 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-17 10:04 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-17 10:04 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-17 10:04 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-17 10:04 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-17 10:04 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-17 10:04 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-16 20:45 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-16 20:45 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-16 20:45 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-16 20:45 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-16 20:45 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-16 20:45 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-16 20:45 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-16 20:45 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-16 20:45 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-16 20:34 - 2013-09-16 21:22 - 00000000 ____D C:\Users\johanna\AppData\Roaming\Nitro PDF
==================== One Month Modified Files and Folders =======
2013-09-19 19:28 - 2010-09-27 21:33 - 00001098 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-19 19:02 - 2009-09-16 23:52 - 01107481 _____ C:\windows\WindowsUpdate.log
2013-09-19 18:28 - 2013-09-19 18:28 - 00000000 ____D C:\Program Files\ESET
2013-09-19 18:25 - 2013-09-19 10:10 - 98378485 _____ C:\windows\system32\洏Ū᭔]
2013-09-19 10:28 - 2010-09-27 21:33 - 00001094 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-18 20:17 - 2013-09-18 20:17 - 00000000 ____D C:\windows\ERUNT
2013-09-18 19:58 - 2009-07-14 04:37 - 00000000 ____D C:\windows\system32\NDF
2013-09-18 19:55 - 2009-07-14 06:34 - 00015056 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-18 19:55 - 2009-07-14 06:34 - 00015056 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-18 19:46 - 2009-09-17 00:44 - 00679724 _____ C:\windows\PFRO.log
2013-09-18 19:46 - 2009-07-14 06:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-18 19:46 - 2009-07-14 06:39 - 00163589 _____ C:\windows\setupact.log
2013-09-18 19:45 - 2013-09-18 11:19 - 00000000 ____D C:\AdwCleaner
2013-09-18 19:27 - 2013-09-18 19:27 - 00000000 ____D C:\Users\johanna\AppData\Roaming\Malwarebytes
2013-09-18 19:27 - 2013-09-18 19:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-18 19:27 - 2013-09-18 19:27 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-18 14:17 - 2013-09-18 14:02 - 00000000 ____D C:\Qoobox
2013-09-18 14:17 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2013-09-18 14:17 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-09-18 14:16 - 2013-09-18 14:16 - 00009526 _____ C:\ComboFix.txt
2013-09-18 14:14 - 2013-09-18 14:02 - 00000000 ____D C:\windows\erdnt
2013-09-18 14:11 - 2009-07-14 04:04 - 00000215 _____ C:\windows\system.ini
2013-09-18 12:28 - 2013-09-18 12:28 - 00000000 ____D C:\FRST
2013-09-18 12:22 - 2013-09-18 12:20 - 00000636 _____ C:\windows\system32\defogger_disable.log
2013-09-18 12:22 - 2013-09-18 12:20 - 00000176 _____ C:\Users\johanna\defogger_reenable
2013-09-18 12:20 - 2010-09-27 20:21 - 00000000 ____D C:\Users\johanna
2013-09-17 22:03 - 2009-07-14 04:37 - 00000000 ____D C:\windows\rescache
2013-09-17 20:35 - 2009-07-14 04:37 - 00000000 ____D C:\windows\Microsoft.NET
2013-09-17 19:56 - 2009-07-26 22:06 - 01520734 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-17 19:16 - 2009-07-14 06:33 - 00421360 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-17 10:06 - 2009-07-14 04:37 - 00000000 ____D C:\windows\system32\de-DE
2013-09-17 10:03 - 2013-08-14 23:10 - 00000000 ____D C:\windows\system32\MRT
2013-09-17 10:01 - 2010-10-10 16:10 - 76725432 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-16 21:22 - 2013-09-16 20:34 - 00000000 ____D C:\Users\johanna\AppData\Roaming\Nitro PDF
2013-09-16 20:39 - 2013-05-02 10:27 - 00066144 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-16 20:39 - 2012-11-28 20:25 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-16 20:39 - 2012-11-28 20:25 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-08-28 14:15 - 2011-01-01 12:22 - 00000000 ____D C:\Users\johanna\AppData\Local\Google
Some content of TEMP:
====================
C:\Users\johanna\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-16 21:10
==================== End Of Log ============================
--- --- --- --- --- --- flashplayer und reader geupdatet neuer security check Code:
ATTFilter Results of screen317's Security Check version 0.99.73 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.1.102.62 Adobe Reader XI ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe ESET ESET Online Scanner OnlineScannerApp.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
| Themen zu Trojaner "TR/Crypt.ZPACK.Gen8" in C:\Users\johanna\AppData\Roaming\skype.dat via Avira gefunden |
| adobe, avg, avira, branding, browser, converter, defender, desktop, device driver, e-banking, farbar, farbar recovery scan tool, fehler, flash player, google, home, installation, mp3, msiexec.exe, plug-in, programm, prozesse, realtek, registry, services.exe, software, stick, svchost.exe, taskhost.exe, tr/crypt.zpack.gen8, trojaner, vista, windows, winlogon.exe |
Hybrid-Darstellung
