| |
| |||||||
Log-Analyse und Auswertung: Bundespolizei Trojaner - auch abgesicherter Modus nicht funktionsfähigWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
16.10.2013, 13:42
| #3 |
 |  Bundespolizei Trojaner - auch abgesicherter Modus nicht funktionsfähig [CODE]rrrr
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by SYSTEM on MININT-2G3B80M on 16-10-2013 13:28:15
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [568888 2010-01-18] ()
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [563736 2009-10-14] (PDF Complete Inc)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [HP Software Update] - c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HP Remote Solution] - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-24] (Hewlett-Packard)
HKLM-x32\...\Run: [BATINDICATOR] - C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe [2068992 2009-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [LaunchHPOSIAPP] - C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe [385024 2009-04-03] (Hewlett-Packard)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-08-06] (McAfee, Inc.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [SweetIM] - C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [115032 2012-05-29] (SweetIM Technologies Ltd.)
HKLM-x32\...\Run: [Sweetpacks Communicator] - C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe [231768 2012-08-15] (SweetIM Technologies Ltd.)
HKLM-x32\...\Run: [CitrixReceiver] - "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [380088 2012-07-26] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [PlantronicsURE.exe] - C:\Program Files (x86)\Plantronics\PlantronicsURE\PlantronicsURE.exe [624120 2012-09-12] (Plantronics, Inc.)
HKLM-x32\...\Run: [PlantronicsBatteryStatus.exe] - C:\Program Files (x86)\Plantronics\PlantronicsURE\PlantronicsBatteryStatus.exe [355832 2012-09-12] (Plantronics, Inc.)
HKLM-x32\...\Run: [NPSStartup] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [mcpltui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-08-06] (McAfee, Inc.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295072 2013-01-20] (RealNetworks, Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)
HKU\Default User\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)
HKU\user\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)
HKU\user\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [247728 2011-03-09] (TomTom)
HKU\user\...\Run: [Steam] - C:\Program Files (x86)\Steam2\steam.exe [1635752 2013-05-03] (Valve Corporation)
HKU\user\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\user\...\Run: [Dashlane] - C:\Users\user\AppData\Roaming\Dashlane\Dashlane.exe [270520 2013-09-30] ()
AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll [257208 2012-07-26] (Citrix Systems, Inc.)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ajhbod.lnk
ShortcutTarget: 4ajhbod.lnk -> C:\PROGRA~3\dobhja4.plz (Borland Software Corporation)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk
ShortcutTarget: Game Alarm.lnk -> C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.)
==================== Services (Whitelisted) =================
S2 CLKMSVC10_C6F09094; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [245232 2010-06-29] (CyberLink)
S2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
S2 hcwD3bda_dvbt; C:\Windows\system32\hauppauge\hcwD3dvb\DVBT\DVBService.exe [2641920 2010-07-15] (Mirics Semiconductor Ltd)
S2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1447728 2013-05-21] ()
S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178048 2013-08-06] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [602944 2013-08-02] (McAfee, Inc.)
S2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1017016 2013-08-04] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-07] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-07] (McAfee, Inc.)
S2 MOBKbackup; C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe [231224 2010-04-13] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-14] (PDF Complete Inc)
S2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
S2 StumbleUponUpdater; C:\Users\user\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe [18432 2011-11-22] ()
S2 SynoDrService; C:\Program Files (x86)\Synology Data Replicator 3\SynoDrServicex64.exe [404480 2007-08-06] ()
S2 Winmgmt; C:\PROGRA~3\4ajhbod.pzz [60512 2013-10-13] (Microsoft Corporation)
S2 Winmgmt; C:\PROGRA~3\4ajhbod.pzz [60512 2013-10-13] (Microsoft Corporation)
S2 0317821381670956mcinstcleanup; C:\Windows\TEMP\031782~1.EXE -cleanup -nolog [x]
==================== Drivers (Whitelisted) ====================
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-12-03] ()
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-08-07] (McAfee, Inc.)
S3 hcwD3bda; C:\Windows\System32\DRIVERS\hcwD3bda64.sys [116352 2010-07-15] (Mirics)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197264 2012-05-28] (McAfee, Inc.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-12-03] ()
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-07] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-07] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-07] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-07] (McAfee, Inc.)
S3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [377040 2013-07-08] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [95984 2013-07-08] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-07] (McAfee, Inc.)
S1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [66040 2010-04-13] (Mozy, Inc.)
S2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
S3 DlinkUDSMBus; SysWOW64\Drivers\DlinkUDSMBus.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-16 13:28 - 2013-10-16 13:28 - 00000000 ____D C:\FRST
2013-10-16 03:21 - 2013-10-16 03:21 - 00012288 ____N C:\bootex.log
2013-10-16 03:21 - 2013-10-16 03:21 - 00003416 ____N C:\bootsqm.dat
2013-10-16 03:19 - 2013-10-16 03:19 - 00000000 __SHD C:\found.000
2013-10-16 01:31 - 2013-10-16 01:31 - 01278464 ____T C:\ProgramData\4ajhbod.fki
2013-10-13 08:27 - 2013-10-16 13:11 - 00000000 ____D C:\8691f74476829e10a740264b02937b
2013-10-13 05:56 - 2013-10-16 03:00 - 00000000 _____ C:\ProgramData\4ajhbod.ctrl
2013-10-13 05:56 - 2013-10-16 02:57 - 95025368 ____T C:\ProgramData\4ajhbod.pff
2013-10-13 05:56 - 2013-10-13 05:56 - 00060512 ____T (Microsoft Corporation) C:\ProgramData\4ajhbod.pzz
2013-10-13 05:55 - 2013-10-13 05:55 - 00176128 _____ (Borland Software Corporation) C:\ProgramData\dobhja4.plz
2013-09-28 05:23 - 2013-09-28 05:23 - 00002730 _____ C:\Windows\System32\RaCoInst.log
2013-09-19 07:26 - 2013-08-09 21:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-19 07:26 - 2013-08-09 21:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-19 07:26 - 2013-08-09 21:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-19 07:26 - 2013-08-09 21:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-19 07:26 - 2013-08-09 21:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-19 07:26 - 2013-08-09 21:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-19 07:26 - 2013-08-09 21:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-19 07:26 - 2013-08-09 19:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-19 07:26 - 2013-08-09 19:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-19 07:26 - 2013-08-09 19:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-19 07:26 - 2013-08-09 19:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-19 07:26 - 2013-08-09 19:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-19 07:26 - 2013-08-09 18:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-19 07:26 - 2013-08-09 18:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-18 22:21 - 2013-09-18 22:21 - 00001785 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-18 22:19 - 2013-09-18 22:20 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-18 22:19 - 2013-09-18 22:20 - 00000000 ____D C:\Program Files\iTunes
2013-09-18 22:19 - 2013-09-18 22:20 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-09-18 22:19 - 2013-09-18 22:19 - 00000000 ____D C:\Program Files\iPod
==================== One Month Modified Files and Folders =======
2013-10-16 13:28 - 2013-10-16 13:28 - 00000000 ____D C:\FRST
2013-10-16 13:11 - 2013-10-13 08:27 - 00000000 ____D C:\8691f74476829e10a740264b02937b
2013-10-16 13:11 - 2013-06-14 22:28 - 00000000 ____D C:\Windows\SysWOW64\ARFC
2013-10-16 13:11 - 2012-01-28 00:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-16 13:11 - 2012-01-28 00:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-16 13:11 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2013-10-16 13:11 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-10-16 13:10 - 2013-06-14 22:28 - 00000000 ____D C:\Windows\SysWOW64\WNLT
2013-10-16 13:09 - 2010-12-07 06:52 - 00000000 ____D C:\ProgramData\Real
2013-10-16 13:03 - 2010-12-01 09:43 - 00000000 ____D C:\ProgramData\Recovery
2013-10-16 03:21 - 2013-10-16 03:21 - 00012288 ____N C:\bootex.log
2013-10-16 03:21 - 2013-10-16 03:21 - 00003416 ____N C:\bootsqm.dat
2013-10-16 03:19 - 2013-10-16 03:19 - 00000000 __SHD C:\found.000
2013-10-16 03:00 - 2013-10-13 05:56 - 00000000 _____ C:\ProgramData\4ajhbod.ctrl
2013-10-16 02:57 - 2013-10-13 05:56 - 95025368 ____T C:\ProgramData\4ajhbod.pff
2013-10-16 01:31 - 2013-10-16 01:31 - 01278464 ____T C:\ProgramData\4ajhbod.fki
2013-10-13 08:31 - 2013-08-14 06:58 - 00000000 ____D C:\Windows\System32\MRT
2013-10-13 06:28 - 2010-10-20 11:57 - 01416450 _____ C:\Windows\WindowsUpdate.log
2013-10-13 06:24 - 2012-04-10 09:52 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-13 06:24 - 2012-04-10 09:52 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-13 06:24 - 2012-04-10 09:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-13 06:24 - 2011-05-16 10:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-13 05:56 - 2013-10-13 05:56 - 00060512 ____T (Microsoft Corporation) C:\ProgramData\4ajhbod.pzz
2013-10-13 05:55 - 2013-10-13 05:55 - 00176128 _____ (Borland Software Corporation) C:\ProgramData\dobhja4.plz
2013-10-13 05:50 - 2013-07-20 05:38 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1ce854e6d96fb9c.job
2013-10-13 05:48 - 2010-12-03 12:26 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-13 05:43 - 2013-07-20 05:38 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1ce854e6d96fb9c
2013-10-13 05:43 - 2010-12-03 12:26 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-13 05:33 - 2012-11-17 06:52 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForuser.job
2013-10-13 05:32 - 2011-10-29 05:01 - 00000000 _____ C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-10-13 05:32 - 2010-12-04 03:06 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-10-13 05:31 - 2010-12-04 03:04 - 00000000 ____D C:\Users\user\AppData\Roaming\HP Support Assistant
2013-10-13 05:31 - 2010-12-02 23:42 - 00000000 ____D C:\Users\user\AppData\Roaming\HpUpdate
2013-10-13 05:29 - 2013-01-09 23:12 - 00000000 ____D C:\Users\user\Documents\Outlook-Dateien
2013-10-13 05:28 - 2009-07-13 20:45 - 00015792 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-13 05:28 - 2009-07-13 20:45 - 00015792 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-13 05:26 - 2010-10-20 12:25 - 00680806 _____ C:\Windows\System32\perfh007.dat
2013-10-13 05:26 - 2010-10-20 12:25 - 00136502 _____ C:\Windows\System32\perfc007.dat
2013-10-13 05:26 - 2009-07-13 21:13 - 01560354 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-13 05:21 - 2012-11-06 22:41 - 00000000 ____D C:\Users\user\AppData\Roaming\Dashlane
2013-10-13 05:20 - 2011-10-22 03:47 - 00000000 ____D C:\Program Files (x86)\Steam2
2013-10-13 05:20 - 2010-10-20 12:04 - 00000000 ____D C:\ProgramData\PDFC
2013-10-13 05:19 - 2012-12-04 23:00 - 00000435 _____ C:\Windows\System32\Drivers\etc\hosts.ics
2013-10-13 05:19 - 2010-10-20 12:00 - 00360196 _____ C:\Windows\PFRO.log
2013-10-13 05:19 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-13 05:19 - 2009-07-13 20:51 - 00088117 _____ C:\Windows\setupact.log
2013-10-04 22:44 - 2010-12-09 02:06 - 00000000 ____D C:\Users\Public\Documents\Crealogix
2013-10-04 22:33 - 2009-07-13 21:32 - 00000000 ____D C:\Windows\System32\FxsTmp
2013-10-04 21:48 - 2012-10-16 21:48 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-10-04 21:17 - 2010-12-09 02:04 - 00000000 ____D C:\Program Files (x86)\CLX.PayMaker
2013-09-28 05:23 - 2013-09-28 05:23 - 00002730 _____ C:\Windows\System32\RaCoInst.log
2013-09-28 05:22 - 2010-06-14 18:07 - 00000000 ____D C:\swsetup
2013-09-26 08:29 - 2010-12-01 09:37 - 00000000 ____D C:\Users\user\AppData\Local\PDFC
2013-09-26 02:42 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-09-23 08:53 - 2009-07-13 20:45 - 00442128 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-19 07:14 - 2010-12-03 05:19 - 00000000 ____D C:\Program Files\Common Files\McAfee
2013-09-18 22:21 - 2013-09-18 22:21 - 00001785 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-18 22:20 - 2013-09-18 22:19 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-18 22:20 - 2013-09-18 22:19 - 00000000 ____D C:\Program Files\iTunes
2013-09-18 22:20 - 2013-09-18 22:19 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-09-18 22:19 - 2013-09-18 22:19 - 00000000 ____D C:\Program Files\iPod
Files to move or delete:
====================
C:\ProgramData\4ajhbod.ctrl
C:\ProgramData\4ajhbod.pff
C:\ProgramData\dobhja4.plz
Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\7za.exe
C:\Users\user\AppData\Local\Temp\COMAP.EXE
C:\Users\user\AppData\Local\Temp\ConfigurationWizard.exe
C:\Users\user\AppData\Local\Temp\drm_dialogs.dll
C:\Users\user\AppData\Local\Temp\drm_dyndata_7270014.dll
C:\Users\user\AppData\Local\Temp\ehujedg6.dll
C:\Users\user\AppData\Local\Temp\Extract.exe
C:\Users\user\AppData\Local\Temp\FlashLockv232.exe
C:\Users\user\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\user\AppData\Local\Temp\GdiPlus.dll
C:\Users\user\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\user\AppData\Local\Temp\i4jdel0.exe
C:\Users\user\AppData\Local\Temp\InstallerMessageBox.exe
C:\Users\user\AppData\Local\Temp\ioqcdqsx.dll
C:\Users\user\AppData\Local\Temp\mgsqlite3.dll
C:\Users\user\AppData\Local\Temp\NPSInstallerProxy.exe
C:\Users\user\AppData\Local\Temp\NPSInstallerProxyMessageBoxHookDll.dll
C:\Users\user\AppData\Local\Temp\pdf24-creator-update.exe
C:\Users\user\AppData\Local\Temp\Resource.exe
C:\Users\user\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\user\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\user\AppData\Local\Temp\SIntf16.dll
C:\Users\user\AppData\Local\Temp\SIntf32.dll
C:\Users\user\AppData\Local\Temp\SIntfNT.dll
C:\Users\user\AppData\Local\Temp\Softonic_chr_1-8-21-14.exe
C:\Users\user\AppData\Local\Temp\sp49905.exe.exe
C:\Users\user\AppData\Local\Temp\sp53904.exe
C:\Users\user\AppData\Local\Temp\sp54931.exe
C:\Users\user\AppData\Local\Temp\sp58915.exe
C:\Users\user\AppData\Local\Temp\SP60924.exe
C:\Users\user\AppData\Local\Temp\SP62055.exe
C:\Users\user\AppData\Local\Temp\stubhelper.dll
C:\Users\user\AppData\Local\Temp\TINST35.EXE
C:\Users\user\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\user\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\user\AppData\Local\Temp\WinTools8366661846577343028.dll
C:\Users\user\AppData\Local\Temp\xvc.exe
C:\Users\user\AppData\Local\Temp\YontooIEClient.dll
C:\Users\user\AppData\Local\Temp\YontooSetup-Silent.exe
C:\Users\user\AppData\Local\Temp\~tmf3899634312168348926.dll
==================== Known DLLs (Whitelisted) ================
C:\Windows\System32\LPK.dll IS MISSING <==== ATTENTION!
C:\Windows\SysWOW64\LPK.dll IS MISSING <==== ATTENTION!
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
8
Restore point made on: 2013-09-19 02:31:39
Restore point made on: 2013-09-19 07:25:25
Restore point made on: 2013-09-27 23:19:36
Restore point made on: 2013-09-28 05:20:53
Restore point made on: 2013-09-28 05:21:43
Restore point made on: 2013-09-28 05:22:33
Restore point made on: 2013-10-13 06:32:32
Restore point made on: 2013-10-13 08:22:15
==================== Memory info ===========================
Percentage of memory in use: 13%
Total physical RAM: 8151.08 MB
Available physical RAM: 7031.96 MB
Total Pagefile: 8149.23 MB
Available Pagefile: 7018.5 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:916.45 GB) (Free:605.75 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:14.96 GB) (Free:1.85 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (STICK ALEX) (Removable) (Total:29.8 GB) (Free:29.8 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: FD87B6C0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=916 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 30 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=30 GB) - (Type=0C)
LastRegBack: 2013-10-13 06:23
==================== End Of Log ============================
--- --- --- Hallo Schrauber Danke für deine Hilfestellung. Hoffe das ist so richtig! Gruss Alex |
| Themen zu Bundespolizei Trojaner - auch abgesicherter Modus nicht funktionsfähig |
| abgesicherten, adware.installbrain, adware.yontoo, anweisung, appdata, explorer.exe, fixlist.txt, pup.dealply, pup.optional.dealply, pup.optional.dealply.a, pup.optional.installbrain.a, pup.optional.installcore.a, pup.optional.sweetim, pup.optional.sweetim.a, pup.optional.sweetpacks, pup.optional.tarma.a, rechner, roaming, runter, thema, trojan.fakems, trojan.ransom.ed, trojaner, windows, winlogon, zugriff |
Baum-Darstellung