| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: 21 Objekte in Avira QuarantäneWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.09.2013, 10:48
| #5 |
 |  21 Objekte in Avira Quarantäne Kein Problem, ich bin dir sehr dankbar für deine Hilfe :-) Code:
ATTFilter # AdwCleaner v3.005 - Bericht erstellt am 24/09/2013 um 11:17:56
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Opa - OPA-PC
# Gestartet von : C:\Users\Opa\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Produkt Gelöscht : Bing Bar
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
*************************
AdwCleaner[R0].txt - [1068 octets] - [24/09/2013 11:16:22]
AdwCleaner[S0].txt - [991 octets] - [24/09/2013 11:17:56]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1050 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.2 (09.22.2013:1)
OS: Windows 7 Home Premium x86
Ran by Opa on 24.09.2013 at 11:40:52,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.09.2013 at 11:42:44,04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-09-2013
Ran by Opa (administrator) on OPA-PC on 24-09-2013 11:45:06
Running from C:\Users\Opa\Downloads
Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Could not list processes ===============
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8391200 2009-12-29] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [678432 2009-12-29] (Realtek Semiconductor)
HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [BDRegion] - C:\Program Files\Cyberlink\Shared Files\brs.exe [75048 2010-01-19] (cyberlink)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [77824 2010-12-28] (Apple Computer, Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-08] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIINE.EXE [246368 2011-11-02] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-25] (Google Inc.)
MountPoints2: F - F:\AutoRun.exe
MountPoints2: {2941a2fa-d4fc-11e1-9dab-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {59f7508c-33cc-11e0-bdc3-00262d224d5f} - F:\AutoRun.exe
MountPoints2: {9eab0e45-104c-11e0-99c0-0025d3a14a57} - F:\AutoRun.exe
MountPoints2: {9eab0e49-104c-11e0-99c0-0025d3a14a57} - F:\AutoRun.exe
MountPoints2: {e7643201-4f63-11e2-9088-0025d3a14a57} - F:\setup.exe AUTORUN=1
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.medion.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.medion.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {CCBCC409-1FF2-4819-BFC9-1D82B5941FD0} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADFA_deAT411
SearchScopes: HKCU - {CCBCC409-1FF2-4819-BFC9-1D82B5941FD0} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADFA_deAT411
SearchScopes: HKCU - {FD9589C0-D1D6-484D-B77E-140DDC8F2020} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: AutorunsDisabled\livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: AutorunsDisabled\msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: AutorunsDisabled\wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
========================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-08] (Avira Operations GmbH & Co. KG)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc.exe [122000 2011-12-12] (Seiko Epson Corporation)
R2 GtDetectSc; C:\Program Files\T-Mobile\web'n'walk Manager\GtDetectSc.exe [200704 2008-04-30] (OptionNV)
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
R2 x10nets; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [20480 2009-11-07] (X10)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-08] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-08] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-29] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [62592 2008-11-07] (Option N.V.)
S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [105984 2008-11-07] (Option N.V.)
S3 GTUHSOMS; C:\Windows\System32\DRIVERS\gtuhsoms.sys [20352 2008-11-07] (Option N.V.)
S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [8064 2008-11-07] (Option N.V.)
R3 hidkmdf; C:\Windows\system32\DRIVERS\hidkmdf.sys [10360 2009-10-29] (Windows (R) Win 7 DDK provider)
R3 NW1950; C:\Windows\system32\DRIVERS\NW1950.sys [22392 2009-10-29] ()
R3 NxpCap; C:\Windows\System32\DRIVERS\NxpCap.sys [1558368 2009-12-22] (NXP Semiconductors Germany GmbH)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-03-01] (Avira GmbH)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
R2 {60DB6561-0A84-4c94-AF33-288405CFD56D}; C:\Program Files\CyberLink\PowerCinema Movie\000.fcl [87536 2009-12-31] (CyberLink Corp.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-24 11:44 - 2013-09-24 11:44 - 01088653 _____ (Farbar) C:\Users\Opa\Downloads\FRST.exe
2013-09-24 11:42 - 2013-09-24 11:42 - 00000623 _____ C:\Users\Opa\Desktop\JRT.txt
2013-09-24 11:34 - 2013-09-24 11:34 - 00000000 ____D C:\Windows\ERUNT
2013-09-24 11:33 - 2013-09-24 11:33 - 01030038 _____ (Thisisu) C:\Users\Opa\Downloads\JRT.exe
2013-09-24 11:16 - 2013-09-24 11:18 - 00000000 ____D C:\AdwCleaner
2013-09-24 11:14 - 2013-09-24 11:14 - 01042066 _____ C:\Users\Opa\Downloads\adwcleaner.exe
2013-09-22 21:02 - 2013-09-22 21:02 - 00022315 _____ C:\Users\Opa\Downloads\Addition.txt
2013-09-22 21:01 - 2013-09-22 21:01 - 00000000 ____D C:\FRST
2013-09-14 19:28 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-14 19:28 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-14 19:28 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-14 19:28 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-14 19:28 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-14 19:28 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-14 19:28 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-14 18:06 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-14 18:06 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-14 18:06 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-14 18:06 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-14 18:06 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 18:06 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-14 18:06 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-14 18:06 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-08 21:46 - 2013-09-08 21:46 - 00511760 _____ C:\Windows\Minidump\090813-21309-01.dmp
==================== One Month Modified Files and Folders =======
2013-09-24 11:44 - 2013-09-24 11:44 - 01088653 _____ (Farbar) C:\Users\Opa\Downloads\FRST.exe
2013-09-24 11:42 - 2013-09-24 11:42 - 00000623 _____ C:\Users\Opa\Desktop\JRT.txt
2013-09-24 11:34 - 2013-09-24 11:34 - 00000000 ____D C:\Windows\ERUNT
2013-09-24 11:33 - 2013-09-24 11:33 - 01030038 _____ (Thisisu) C:\Users\Opa\Downloads\JRT.exe
2013-09-24 11:31 - 2012-12-26 17:38 - 01155164 _____ C:\Users\Opa\AppData\Local\Optimizer.txt
2013-09-24 11:27 - 2009-07-14 06:34 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-24 11:27 - 2009-07-14 06:34 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-24 11:19 - 2010-07-22 18:33 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-24 11:19 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-24 11:19 - 2009-07-14 06:39 - 00106392 _____ C:\Windows\setupact.log
2013-09-24 11:18 - 2013-09-24 11:16 - 00000000 ____D C:\AdwCleaner
2013-09-24 11:18 - 2010-12-25 19:29 - 01428744 _____ C:\Windows\WindowsUpdate.log
2013-09-24 11:14 - 2013-09-24 11:14 - 01042066 _____ C:\Users\Opa\Downloads\adwcleaner.exe
2013-09-24 11:11 - 2010-07-09 17:52 - 00000000 ____D C:\Program Files\Java
2013-09-24 11:07 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-24 11:04 - 2013-08-03 09:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-22 21:54 - 2013-08-03 09:03 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-22 21:54 - 2013-08-03 09:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-22 21:02 - 2013-09-22 21:02 - 00022315 _____ C:\Users\Opa\Downloads\Addition.txt
2013-09-22 21:01 - 2013-09-22 21:01 - 00000000 ____D C:\FRST
2013-09-15 22:07 - 2009-07-14 06:33 - 00287744 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-15 22:06 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-14 18:05 - 2013-08-03 11:16 - 00000000 ____D C:\Windows\system32\MRT
2013-09-14 18:02 - 2010-07-06 23:03 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-08 22:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-09-08 21:46 - 2013-09-08 21:46 - 00511760 _____ C:\Windows\Minidump\090813-21309-01.dmp
2013-09-08 21:46 - 2013-02-08 10:29 - 358809224 _____ C:\Windows\MEMORY.DMP
2013-09-08 21:46 - 2013-02-08 10:29 - 00000000 ____D C:\Windows\Minidump
2013-09-08 13:35 - 2013-05-08 09:39 - 00066144 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-08 13:35 - 2013-03-01 01:22 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-08 13:35 - 2013-03-01 01:22 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-01 19:10 - 2012-12-26 18:05 - 00000000 ____D C:\Users\Opa\AppData\Local\web'n'walk Manager
2013-08-25 11:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
Files to move or delete:
====================
C:\ProgramData\to_r0tsef.pad
C:\Users\Opa\d3dx9_30.dll
C:\Users\Opa\Rommé.exe
C:\Users\Opa\Uninstal.exe
Some content of TEMP:
====================
C:\Users\Opa\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-08 22:16
==================== End Of Log ============================
--- --- --- |
| Themen zu 21 Objekte in Avira Quarantäne |
| appdata, cache, exp/cve-2013-2423.f.gen, exp/java.hlp.ck, files, funde, html/expkit.gen3, html/rce.gen3, interne, java, java/dldr.dermit.is, java/jogek.caw, machbar, neu, roaming, spielen, system, system neu, tr/psw.zbot.339968.104, tr/spy.zbot.257024, tr/spy.zbot.kqal, treiber, win32/reveton.m, works |
Baum-Darstellung