![]() |
|
Log-Analyse und Auswertung: Antivirus Security ProWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() Antivirus Security Pro Hallo, auf dem Laptop meiner Frau hat sich der Virus "Antivirus SEcurity Pro" eingeschlissen. Ich habe versucht einiges aus dem Internet aufzunehmen und auszuprobieren. Der abgesicherte Modus funktioniert nicht, es wird jedesmal abgebrochen und in den normalen STart-Modus umgeschwenkt. Auch kann ich keine Dateien installieren und löschen. Der Task-Manager funktioniert auch nicht. Als Letztes habe ich die Anweisung auf trojaner-board.de mit der Ausführung des scan mit FRST.exe über Computer reparierern/UsB-Stick durchgeführt. Hier das Logfile von dem SCan. Wäre super, wenn Ihr mir weiterhelfen könntet !!!! Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013 Ran by SYSTEM on MININT-O9ARHIK on 09-10-2013 09:13:06 Running from G:\ Windows 7 Home Premium (X86) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [102400 2010-07-30] (Advanced Micro Devices, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1725736 2010-04-22] (Synaptics Incorporated) HKLM\...\Run: [MGSysCtrl] - C:\Program Files\System Control Manager\MGSysCtrl.exe [2482176 2010-07-19] (Micro-Star International Co., Ltd.) HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9267816 2010-06-08] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1481320 2010-06-08] (Realtek Semiconductor) HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM\...\Run: [] - [x] HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [PDFPrint] - C:\Program Files\PDF24\pdf24.exe [162856 2013-02-19] (Geek Software GmbH) HKLM\...\Run: [AS2014] - C:\ProgramData\3VvpnnpD\3VvpnnpD.exe [527360 2013-10-08] () HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [360448 2009-07-14] (Microsoft Corporation) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,,C:\ProgramData\3VvpnnpD\3VvpnnpD.exe -sm, HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [ 2009-10-22] () HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [ 2009-10-22] () HKU\Miyesser\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2011-05-29] (Google Inc.) HKU\Miyesser\...\Run: [HP Deskjet 3520 series (NET)] - C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [ 2012-01-31] (Hewlett-Packard Co.) HKU\Miyesser\...\Run: [Google Update] - [x] HKU\Miyesser\...\Run: [AS2014] - C:\ProgramData\3VvpnnpD\3VvpnnpD.exe [ 2013-10-08] () ========================== Services (Whitelisted) ================= S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) S2 Micro Star SCM; C:\Program Files\System Control Manager\MSIService.exe [160768 2009-07-09] (Micro-Star International Co., Ltd.) S2 *etadpug; "C:\Program Files\Google\Desktop\Install\{3e7df94a-338f-d542-dc0e-f7f33dadeb0e}\ \...\???\{3e7df94a-338f-d542-dc0e-f7f33dadeb0e}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess) ==================== Drivers (Whitelisted) ==================== S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [101904 2010-08-16] (ATI Technologies, Inc.) S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation) S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.) S3 massfilter; system32\drivers\massfilter.sys [x] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-09 09:12 - 2013-10-09 09:12 - 00000000 ____D C:\FRST 2013-10-08 14:46 - 2013-10-08 14:46 - 00000706 _____ C:\Windows\PFRO.log 2013-10-08 14:46 - 2013-10-08 14:46 - 00000056 _____ C:\Windows\setupact.log 2013-10-08 14:46 - 2013-10-08 14:46 - 00000000 _____ C:\Windows\setuperr.log 2013-10-08 12:49 - 2013-10-08 12:47 - 10156344 _____ (Malwarebytes Corporation ) C:\Users\Miyesser\Desktop\mbam-setup-1.70.0.1100.exe 2013-10-08 12:33 - 2013-10-08 12:32 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Miyesser\Documents\SpyHunter-Installer.exe 2013-10-08 10:53 - 2013-10-08 10:53 - 00065024 _____ C:\Windows\System32\Flaslder.dll 2013-10-08 10:47 - 2013-10-08 14:47 - 00001670 _____ C:\Users\Miyesser\Desktop\Antivirus Security Pro.lnk 2013-10-08 10:47 - 2013-10-08 14:47 - 00000118 _____ C:\Users\Miyesser\Desktop\Antivirus Security Pro support.url 2013-10-08 10:38 - 2013-10-08 12:23 - 00000000 ____D C:\ProgramData\3VvpnnpD 2013-09-24 13:29 - 2013-09-24 13:29 - 00000000 ____D C:\Windows\Minidump 2013-09-23 22:45 - 2013-09-23 22:45 - 00632288 ____N C:\Windows\Minidump\092413-23337-01.dmp 2013-09-12 00:42 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-09-12 00:42 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-09-12 00:41 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-09-12 00:41 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-09-12 00:41 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-09-12 00:41 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-09-12 00:41 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-09-12 00:41 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-09-11 13:26 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll 2013-09-11 13:25 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-09-11 13:25 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys 2013-09-11 13:25 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll 2013-09-11 13:25 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll 2013-09-11 13:25 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe 2013-09-11 13:25 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-11 13:25 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll 2013-09-11 13:25 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll ==================== One Month Modified Files and Folders ======= 2013-10-09 09:12 - 2013-10-09 09:12 - 00000000 ____D C:\FRST 2013-10-08 14:47 - 2013-10-08 10:47 - 00001670 _____ C:\Users\Miyesser\Desktop\Antivirus Security Pro.lnk 2013-10-08 14:47 - 2013-10-08 10:47 - 00000118 _____ C:\Users\Miyesser\Desktop\Antivirus Security Pro support.url 2013-10-08 14:46 - 2013-10-08 14:46 - 00000706 _____ C:\Windows\PFRO.log 2013-10-08 14:46 - 2013-10-08 14:46 - 00000056 _____ C:\Windows\setupact.log 2013-10-08 14:46 - 2013-10-08 14:46 - 00000000 _____ C:\Windows\setuperr.log 2013-10-08 14:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles 2013-10-08 13:33 - 2009-07-14 05:34 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-08 13:33 - 2009-07-14 05:34 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-08 12:49 - 2010-10-26 13:24 - 01500104 _____ C:\Windows\System32\PerfStringBackup.INI 2013-10-08 12:47 - 2013-10-08 12:49 - 10156344 _____ (Malwarebytes Corporation ) C:\Users\Miyesser\Desktop\mbam-setup-1.70.0.1100.exe 2013-10-08 12:32 - 2013-10-08 12:33 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Miyesser\Documents\SpyHunter-Installer.exe 2013-10-08 12:23 - 2013-10-08 10:38 - 00000000 ____D C:\ProgramData\3VvpnnpD 2013-10-08 10:53 - 2013-10-08 10:53 - 00065024 _____ C:\Windows\System32\Flaslder.dll 2013-10-08 10:39 - 2011-05-29 06:26 - 00000000 ____D C:\Program Files\Google 2013-10-08 10:38 - 2011-05-29 20:09 - 00000000 ____D C:\Users\Miyesser\AppData\Local\Google 2013-09-30 22:14 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache 2013-09-24 13:29 - 2013-09-24 13:29 - 00000000 ____D C:\Windows\Minidump 2013-09-23 22:45 - 2013-09-23 22:45 - 00632288 ____N C:\Windows\Minidump\092413-23337-01.dmp 2013-09-19 18:10 - 2012-07-26 23:38 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2013-09-19 18:10 - 2011-09-10 19:58 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2013-09-12 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET 2013-09-12 21:08 - 2009-07-14 05:33 - 00431112 _____ C:\Windows\System32\FNTCACHE.DAT 2013-09-12 21:06 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE 2013-09-12 00:51 - 2013-02-19 08:51 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-12 00:51 - 2011-07-02 22:00 - 00000000 ____D C:\Program Files\Microsoft Application Virtualization Client 2013-09-12 00:39 - 2013-07-19 08:45 - 00000000 ____D C:\Windows\System32\MRT 2013-09-12 00:37 - 2010-10-26 13:22 - 76725432 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe Files to move or delete: ==================== ZeroAccess: C:\Users\Miyesser\AppData\Local\Google\Desktop\Install ZeroAccess: C:\Program Files\Google\Desktop\Install ==================== Known DLLs (Whitelisted) ============ ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= 11 Restore point made on: 2013-09-03 09:02:33 Restore point made on: 2013-09-04 08:56:22 Restore point made on: 2013-09-05 11:42:37 Restore point made on: 2013-09-10 07:13:20 Restore point made on: 2013-09-12 00:36:45 Restore point made on: 2013-09-17 07:49:10 Restore point made on: 2013-09-20 21:29:33 Restore point made on: 2013-09-24 15:17:01 Restore point made on: 2013-09-27 17:21:51 Restore point made on: 2013-10-01 14:06:23 Restore point made on: 2013-10-04 20:52:40 ==================== Memory info =========================== Percentage of memory in use: 13% Total physical RAM: 3839.24 MB Available physical RAM: 3328.76 MB Total Pagefile: 3837.52 MB Available Pagefile: 3322.81 MB Total Virtual: 2047.88 MB Available Virtual: 1943.8 MB ==================== Drives ================================ Drive c: (BOOT) (Fixed) (Total:424.66 GB) (Free:270.66 GB) NTFS Drive e: (Recover) (Fixed) (Total:40 GB) (Free:30.87 GB) NTFS Drive g: (USB DISK) (Removable) (Total:0.94 GB) (Free:0.77 GB) FAT Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: () (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: B8FA3ECD) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=425 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ======================================================== Disk: 1 (MBR Code: Windows XP) (Size: 968 MB) (Disk ID: C3072E18) Partition 1: (Not Active) - (Size=967 MB) - (Type=06) LastRegBack: 2013-10-01 20:15 ==================== End Of Log ============================ |
Themen zu Antivirus Security Pro |
adobe, antivirus, association, computer, defender, desktop, explorer, farbar, farbar recovery scan tool, google, home, internet, logfile, malwarebytes, microsoft, realtek, registry, scan, security, services.exe, software, super, svchost.exe, system, task-manager, virus, windows xp, winlogon, winlogon.exe |