| |
| |||||||
Log-Analyse und Auswertung: PC läuft nach ZBot Entfernung langsamerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
15.11.2013, 20:26
| #19 |
 |  PC läuft nach ZBot Entfernung langsamer Fixlog Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-11-2013
Ran by Sabrina at 2013-11-15 20:07:28 Run:1
Running from C:\Users\Sabrina\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKCU\...\Run: [xeyeytcn] - C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj\lrfemhytcn.exe [133632 2013-11-07] ()
C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj
CMD: dir /a/b "C:\Users\Sabrina\AppData\Roaming"
*****************
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\xeyeytcn => Value deleted successfully.
"C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj" directory move:
Could not move "C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj\lrfemhytcn.exe" => Scheduled to move on reboot.
Could not move "C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj" directory. => Scheduled to move on reboot.
========= dir /a/b "C:\Users\Sabrina\AppData\Roaming" =========
Adobe
Asus WebStorage
ATI
dvdcss
DVDVideoSoft
EAC
ICQ-Profile
ICQM
Identities
Macromedia
Media Center Programs
Microsoft
Mozilla
Nlcpfvxgj
Samsung
Skype
vlc
========= End of CMD: =========
=========== Result of Scheduled Files to move ===========
"C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj\lrfemhytcn.exe" => File could not move.
"C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj" => Directory could not move.
==== End of Fixlog ====
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2013
Ran by Sabrina (administrator) on ASUS-PC on 15-11-2013 20:19:54
Running from C:\Users\Sabrina\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe
() C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BBSvc.exe
() C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(ECAREME) C:\Program Files (x86)\ASUS\Asus WebStorage\BackupService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(ICQ) C:\Users\Sabrina\AppData\Roaming\ICQM\icq.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ASUS) C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDECK.EXE
(ASUS) C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\sysWOW64\wbem\wmiprvse.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EeeStorageBackup] - C:\Program Files (x86)\ASUS\Asus WebStorage\BackupService.exe [947472 2009-08-25] (ECAREME)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [619392 2009-06-12] (ELAN Microelectronic Corp.)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-01] (AlcorMicro Co., Ltd.)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)
HKCU\...\Run: [icq] - C:\Users\Sabrina\AppData\Roaming\ICQM\icq.exe [29919576 2013-10-26] (ICQ)
HKCU\...\Run: [xeyeytcn] - C:\Users\Sabrina\AppData\Roaming\Nlcpfvxgj\lrfemhytcn.exe [133632 2013-11-07] ()
HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-10-02] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [6859392 2009-08-17] (ASUS)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDECK.EXE [2245120 2009-09-17] (VIA)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [159744 2009-04-20] (ASUS)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-10-31] (Avira Operations GmbH & Co. KG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Sabrina\AppData\Roaming\Mozilla\Firefox\Profiles\iyxvaayp.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
R2 OberonGameConsoleService; C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
==================== Drivers (Whitelisted) ====================
R2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] ()
S3 ASPI; C:\Windows\SysWow64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [83160 2013-10-31] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-05-20] ()
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [204568 2013-08-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U2 TMAgent;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-15 19:04 - 2013-11-15 19:04 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-15 19:04 - 2013-11-15 19:04 - 00000000 ____D C:\ProgramData\Avira
2013-11-15 19:04 - 2013-11-15 19:04 - 00000000 ____D C:\Program Files (x86)\Avira
2013-11-15 19:04 - 2013-10-31 19:25 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-15 19:04 - 2013-10-31 19:25 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-15 19:04 - 2013-10-31 19:25 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-15 19:04 - 2013-10-31 19:25 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-15 17:48 - 2013-11-15 17:48 - 00000610 _____ C:\Windows\system32\TmInstall.log
2013-11-15 17:24 - 2013-09-03 13:35 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-15 17:23 - 2012-05-02 20:25 - 00232464 _____ (Trend Micro Inc.) C:\Windows\TmNSCIns.dll
2013-11-15 17:18 - 2013-11-15 17:19 - 126764512 _____ C:\Users\Sabrina\Downloads\avira_free1401_antivirus_de.exe
2013-11-15 17:15 - 2013-11-15 20:19 - 00010099 _____ C:\Users\Sabrina\Desktop\FRST.txt
2013-11-15 17:09 - 2013-11-15 17:09 - 00018937 _____ C:\ComboFix.txt
2013-11-15 16:36 - 2013-11-15 17:09 - 00000000 ____D C:\Qoobox
2013-11-15 16:36 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-15 16:36 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-15 16:36 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-15 16:36 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-15 16:36 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-15 16:36 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-15 16:36 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-15 16:36 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-15 16:35 - 2013-11-15 16:51 - 00000000 ____D C:\Windows\erdnt
2013-11-15 16:35 - 2013-11-15 16:30 - 05146278 ____R (Swearware) C:\Users\Sabrina\Desktop\ComboFix.exe
2013-11-15 13:32 - 2013-11-15 20:11 - 00000000 ____D C:\FRST
2013-11-15 13:32 - 2013-11-15 13:30 - 01957794 _____ (Farbar) C:\Users\Sabrina\Desktop\FRST64.exe
2013-11-14 12:33 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 12:33 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 12:33 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 12:33 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 12:33 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 12:33 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 12:33 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 12:33 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 12:33 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 12:33 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 12:33 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 12:33 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-13 18:05 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 18:05 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 18:05 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 18:05 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 18:05 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 18:05 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 18:05 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 18:05 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 18:05 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 18:05 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 18:05 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 18:05 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 18:05 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 18:05 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 18:04 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 18:04 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 18:04 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 18:04 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 18:04 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 18:04 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 18:04 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 18:04 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 18:04 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 18:04 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 18:04 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 18:04 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 18:04 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 18:04 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 18:04 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 18:04 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 17:59 - 2013-11-13 17:59 - 04522861 _____ C:\Users\Sabrina\Downloads\agsetup183se(1).exe
2013-11-10 20:11 - 2013-11-10 20:11 - 00000000 ____D C:\Users\Sabrina\Documents\Starter
2013-11-10 19:38 - 2013-11-10 19:38 - 00000000 ____D C:\Users\Sabrina\Documents\Bonus
2013-11-10 19:03 - 2013-11-10 19:03 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-10 19:01 - 2013-11-10 19:38 - 00000000 ____D C:\Users\Sabrina\Documents\VIDEO_TS
2013-11-10 18:59 - 2013-11-10 18:59 - 00001128 _____ C:\Users\Public\Desktop\Legacy of Kain - Defiance.lnk
2013-11-10 18:57 - 2013-11-10 18:59 - 00000000 ____D C:\Program Files (x86)\Legacy of Kain - Defiance
2013-11-10 18:13 - 2013-11-10 18:13 - 00000000 ____D C:\Users\Sabrina\Documents\Manual
2013-11-10 17:55 - 2013-11-10 20:11 - 00000000 ____D C:\Users\Sabrina\Documents\files
2013-11-10 17:55 - 2013-11-10 19:40 - 00000000 ____D C:\Users\Sabrina\Documents\DirectX9
2013-11-10 17:54 - 2013-11-10 17:55 - 00000000 ____D C:\Users\Sabrina\Documents\0data
2013-11-10 17:52 - 2013-11-10 19:33 - 00000000 ____D C:\Users\Sabrina\Documents\Legacy of Kain - Defiance
2013-11-10 17:51 - 2013-11-10 17:51 - 00001032 _____ C:\Users\Public\Desktop\Roadkil's Unstoppable Copier.lnk
2013-11-10 17:51 - 2013-11-10 17:51 - 00000000 ____D C:\Program Files (x86)\Roadkil.Net
2013-11-10 17:50 - 2013-11-10 17:50 - 00427256 _____ (Roadkil.Net ) C:\Users\Sabrina\Downloads\UnstopCpy_5_2_Win2K_UP_Setup.exe
2013-11-10 17:45 - 2013-11-10 17:45 - 00003080 _____ C:\Windows\System32\Tasks\{1B4F22C6-D152-4A89-B160-8AEEF4C4A912}
2013-11-10 16:29 - 2013-11-10 19:36 - 00000000 ____D C:\_CDRestored
2013-11-10 16:29 - 2013-11-10 16:29 - 00001226 _____ C:\Users\Sabrina\Desktop\CD Recovery Toolbox Free.lnk
2013-11-10 16:29 - 2013-11-10 16:29 - 00000000 ____D C:\Program Files (x86)\CD Recovery Toolbox Free
2013-11-10 16:28 - 2013-11-10 16:28 - 02456056 _____ (Recovery Toolbox, Inc. ) C:\Users\Sabrina\Downloads\CDRecoveryToolboxFreeSetup_2.0.0.0.exe
2013-11-07 18:50 - 2013-11-07 18:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-26 12:14 - 2013-10-27 17:04 - 00001892 _____ C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\ICQ.lnk
2013-10-26 12:14 - 2013-10-26 12:14 - 00001811 _____ C:\Users\Sabrina\Desktop\ICQ.lnk
2013-10-26 12:14 - 2013-10-26 12:14 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICQ
2013-10-26 12:13 - 2013-10-26 12:14 - 35932488 _____ (ICQ) C:\Users\Sabrina\Downloads\icq_rfrset.exe
==================== One Month Modified Files and Folders =======
2013-11-15 20:21 - 2013-11-15 17:15 - 00010099 _____ C:\Users\Sabrina\Desktop\FRST.txt
2013-11-15 20:16 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-15 20:16 - 2009-07-14 05:51 - 00047966 _____ C:\Windows\setupact.log
2013-11-15 20:15 - 2009-12-10 11:18 - 01129582 _____ C:\Windows\WindowsUpdate.log
2013-11-15 20:15 - 2009-07-14 05:45 - 00010016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-15 20:15 - 2009-07-14 05:45 - 00010016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-15 20:11 - 2013-11-15 13:32 - 00000000 ____D C:\FRST
2013-11-15 20:08 - 2013-08-03 17:01 - 00025170 _____ C:\Windows\PFRO.log
2013-11-15 20:06 - 2013-08-06 15:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-15 20:01 - 2009-12-10 12:19 - 00001918 _____ C:\Windows\system32\AutoRunFilter.ini
2013-11-15 20:01 - 2009-12-10 12:19 - 00001433 _____ C:\Windows\system32\ServiceFilter.ini
2013-11-15 19:04 - 2013-11-15 19:04 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-15 19:04 - 2013-11-15 19:04 - 00000000 ____D C:\ProgramData\Avira
2013-11-15 19:04 - 2013-11-15 19:04 - 00000000 ____D C:\Program Files (x86)\Avira
2013-11-15 17:48 - 2013-11-15 17:48 - 00000610 _____ C:\Windows\system32\TmInstall.log
2013-11-15 17:19 - 2013-11-15 17:18 - 126764512 _____ C:\Users\Sabrina\Downloads\avira_free1401_antivirus_de.exe
2013-11-15 17:09 - 2013-11-15 17:09 - 00018937 _____ C:\ComboFix.txt
2013-11-15 17:09 - 2013-11-15 16:36 - 00000000 ____D C:\Qoobox
2013-11-15 17:06 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-15 16:53 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-11-15 16:51 - 2013-11-15 16:35 - 00000000 ____D C:\Windows\erdnt
2013-11-15 16:30 - 2013-11-15 16:35 - 05146278 ____R (Swearware) C:\Users\Sabrina\Desktop\ComboFix.exe
2013-11-15 13:41 - 2009-08-04 11:40 - 00385526 _____ C:\Windows\system32\perfh00D.dat
2013-11-15 13:41 - 2009-08-04 11:40 - 00084668 _____ C:\Windows\system32\perfc00D.dat
2013-11-15 13:41 - 2009-08-04 11:34 - 00599418 _____ C:\Windows\system32\perfh008.dat
2013-11-15 13:41 - 2009-08-04 11:34 - 00110760 _____ C:\Windows\system32\perfc008.dat
2013-11-15 13:41 - 2009-08-04 11:28 - 00721734 _____ C:\Windows\system32\prfh0816.dat
2013-11-15 13:41 - 2009-08-04 11:28 - 00152656 _____ C:\Windows\system32\prfc0816.dat
2013-11-15 13:41 - 2009-08-04 11:22 - 00402400 _____ C:\Windows\system32\prfh0404.dat
2013-11-15 13:41 - 2009-08-04 11:22 - 00121962 _____ C:\Windows\system32\prfc0404.dat
2013-11-15 13:41 - 2009-08-04 11:15 - 00735912 _____ C:\Windows\system32\perfh013.dat
2013-11-15 13:41 - 2009-08-04 11:15 - 00152684 _____ C:\Windows\system32\perfc013.dat
2013-11-15 13:41 - 2009-08-04 11:09 - 00732734 _____ C:\Windows\system32\perfh010.dat
2013-11-15 13:41 - 2009-08-04 11:09 - 00146556 _____ C:\Windows\system32\perfc010.dat
2013-11-15 13:41 - 2009-08-04 11:03 - 00738198 _____ C:\Windows\system32\perfh00C.dat
2013-11-15 13:41 - 2009-08-04 11:03 - 00149060 _____ C:\Windows\system32\perfc00C.dat
2013-11-15 13:41 - 2009-08-04 10:57 - 00738042 _____ C:\Windows\system32\perfh00A.dat
2013-11-15 13:41 - 2009-08-04 10:57 - 00158092 _____ C:\Windows\system32\perfc00A.dat
2013-11-15 13:41 - 2009-08-04 10:51 - 00700418 _____ C:\Windows\system32\perfh007.dat
2013-11-15 13:41 - 2009-08-04 10:51 - 00149182 _____ C:\Windows\system32\perfc007.dat
2013-11-15 13:41 - 2009-07-14 06:13 - 07743402 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-15 13:30 - 2013-11-15 13:32 - 01957794 _____ (Farbar) C:\Users\Sabrina\Desktop\FRST64.exe
2013-11-14 12:58 - 2013-08-14 19:59 - 00000000 ____D C:\Windows\system32\MRT
2013-11-14 12:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\he-IL
2013-11-14 12:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\he-IL
2013-11-14 12:33 - 2009-12-10 11:30 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 12:27 - 2013-08-04 00:53 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 17:59 - 2013-11-13 17:59 - 04522861 _____ C:\Users\Sabrina\Downloads\agsetup183se(1).exe
2013-11-10 20:15 - 2013-08-03 16:33 - 00032417 _____ C:\Windows\DirectX.log
2013-11-10 20:11 - 2013-11-10 20:11 - 00000000 ____D C:\Users\Sabrina\Documents\Starter
2013-11-10 20:11 - 2013-11-10 17:55 - 00000000 ____D C:\Users\Sabrina\Documents\files
2013-11-10 19:40 - 2013-11-10 17:55 - 00000000 ____D C:\Users\Sabrina\Documents\DirectX9
2013-11-10 19:38 - 2013-11-10 19:38 - 00000000 ____D C:\Users\Sabrina\Documents\Bonus
2013-11-10 19:38 - 2013-11-10 19:01 - 00000000 ____D C:\Users\Sabrina\Documents\VIDEO_TS
2013-11-10 19:36 - 2013-11-10 16:29 - 00000000 ____D C:\_CDRestored
2013-11-10 19:33 - 2013-11-10 17:52 - 00000000 ____D C:\Users\Sabrina\Documents\Legacy of Kain - Defiance
2013-11-10 19:03 - 2013-11-10 19:03 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-10 18:59 - 2013-11-10 18:59 - 00001128 _____ C:\Users\Public\Desktop\Legacy of Kain - Defiance.lnk
2013-11-10 18:59 - 2013-11-10 18:57 - 00000000 ____D C:\Program Files (x86)\Legacy of Kain - Defiance
2013-11-10 18:13 - 2013-11-10 18:13 - 00000000 ____D C:\Users\Sabrina\Documents\Manual
2013-11-10 17:55 - 2013-11-10 17:54 - 00000000 ____D C:\Users\Sabrina\Documents\0data
2013-11-10 17:51 - 2013-11-10 17:51 - 00001032 _____ C:\Users\Public\Desktop\Roadkil's Unstoppable Copier.lnk
2013-11-10 17:51 - 2013-11-10 17:51 - 00000000 ____D C:\Program Files (x86)\Roadkil.Net
2013-11-10 17:50 - 2013-11-10 17:50 - 00427256 _____ (Roadkil.Net ) C:\Users\Sabrina\Downloads\UnstopCpy_5_2_Win2K_UP_Setup.exe
2013-11-10 17:45 - 2013-11-10 17:45 - 00003080 _____ C:\Windows\System32\Tasks\{1B4F22C6-D152-4A89-B160-8AEEF4C4A912}
2013-11-10 17:41 - 2013-08-04 16:25 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\vlc
2013-11-10 16:29 - 2013-11-10 16:29 - 00001226 _____ C:\Users\Sabrina\Desktop\CD Recovery Toolbox Free.lnk
2013-11-10 16:29 - 2013-11-10 16:29 - 00000000 ____D C:\Program Files (x86)\CD Recovery Toolbox Free
2013-11-10 16:28 - 2013-11-10 16:28 - 02456056 _____ (Recovery Toolbox, Inc. ) C:\Users\Sabrina\Downloads\CDRecoveryToolboxFreeSetup_2.0.0.0.exe
2013-11-10 14:29 - 2009-12-10 11:52 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-11-08 20:34 - 2013-08-04 12:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-07 18:50 - 2013-11-07 18:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-31 19:25 - 2013-11-15 19:04 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-31 19:25 - 2013-11-15 19:04 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-31 19:25 - 2013-11-15 19:04 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-31 19:25 - 2013-11-15 19:04 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-27 17:04 - 2013-10-26 12:14 - 00001892 _____ C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\ICQ.lnk
2013-10-26 20:11 - 2013-09-24 21:11 - 00000000 ____D C:\Users\Sabrina\Documents\DVDVideoSoft
2013-10-26 12:15 - 2013-08-03 16:32 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\ICQ-Profile
2013-10-26 12:14 - 2013-10-26 12:14 - 00001811 _____ C:\Users\Sabrina\Desktop\ICQ.lnk
2013-10-26 12:14 - 2013-10-26 12:14 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICQ
2013-10-26 12:14 - 2013-10-26 12:13 - 35932488 _____ (ICQ) C:\Users\Sabrina\Downloads\icq_rfrset.exe
2013-10-26 12:14 - 2013-08-03 16:32 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\ICQM
2013-10-19 17:50 - 2013-08-04 16:26 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\dvdcss
Some content of TEMP:
====================
C:\Users\Sabrina\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2009-07-29 06:04
==================== End Of Log ============================
--- --- --- |
| Themen zu PC läuft nach ZBot Entfernung langsamer |
| b.exe, besser, boxen, computer, dateien, entfernung, gelöscht, guten, hochfahren, langsamer, malwarebytes, musik, netzwerk, neuinstallation, programm, programme, seite, stimmen, system, telekom, trojaner, verdächtige, windows, windows xp, zbot |
Baum-Darstellung