| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: MWB-fund:Trojan.Inject,Trojan. Ransomware und SpywareWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.12.2013, 15:30
| #16 |
 |  MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware Der Fix hat irgendwie auch nicht so ganz geklappt. Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-12-2013 01
Ran by BEKS at 2013-12-24 13:25:10 Run:10
Running from C:\Users\BEKS\Desktop\VirEntfernung\frst
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\Gast\...\Run: [IExplorer Util] - C:\Users\Gast\AppData\Roaming\ie_util.exe
C:\Users\Gast\AppData\Roaming\*.exe
*****************
HKU\Gast\Software\Microsoft\Windows\CurrentVersion\Run\\IExplorer Util => Value deleted successfully.
"C:\Users\Gast\AppData\Roaming\*.exe" => File/Directory not found.
==== End of Fixlog ====
FRST konnte die Datei irgendwie nicht auffinden. Neuer Scan: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2013 01
Ran by BEKS (administrator) on -BEKS- on 24-12-2013 13:59:52
Running from C:\Users\BEKS\Desktop\VirEntfernung\frst
Microsoft® Windows Vista™ Home Premium (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
() C:\Program Files\AAVUpdateManager\aavus.exe
() C:\Acer\ALaunch\ALaunchSvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eNet\eNet Service.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
() C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
(acer) C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVM Berlin GmbH) C:\Program Files\avmwlanstick\FRITZWLANMini.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Desktop.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-07-27] (Microsoft Corporation)
HKLM\...\Run: [Acer Tour] - REM
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [768520 2007-07-16] (Dritek System Inc.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [159744 2007-06-06] (Alps Electric Co., Ltd.)
HKLM\...\Run: [eRecoveryService] - [x]
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [323584 2006-04-20] (AVM Berlin GmbH)
HKLM\...\Run: [NPSStartup] - REM
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2508104 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [PlayMovie] - C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [206952 2007-05-24] (CyberLink Corp.)
HKLM\...\Run: [Bluetooth Connection Assistant] - REM LBTWIZ.EXE -silent
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [Acer Tour Reminder] - REM
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125440 2006-11-02] (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2009-04-02] (Samsung Electronics Co., Ltd.)
MountPoints2: F - F:\pushinst.exe
MountPoints2: {21354a54-c359-11e0-a164-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\BRIAn.Exe
MountPoints2: {5f7dc652-7ce4-11dd-861f-001dd96654c5} - F:\pushinst.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\RunOnce: [AcerScrSav] - C:\Windows\ACER\run_NB.exe [ 2007-04-26] ()
HKU\Gast\...\Run: [Acer Tour Reminder] - [x]
HKU\Gast\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2006-11-02] (Microsoft Corporation)
HKU\Gast\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
Startup: C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {D6AB3521-A556-4730-ADBB-9BDCB72BAD7D} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
========================== Services (Whitelisted) =================
R2 AAV UpdateService; C:\Program Files\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ALaunchService; C:\Acer\ALaunch\ALaunchSvc.exe [50688 2007-01-26] ()
R2 eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [135168 2007-05-22] (Acer Inc.)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-02-13] (Acer Inc.)
R2 eSettingsService; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [24576 2007-05-10] ()
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-09-08] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [107008 2006-11-24] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-01-23] ()
R2 WMIService; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [163840 2007-05-16] (acer)
==================== Drivers (Whitelisted) ====================
R1 DritekPortIO; C:\Program Files\Launch Manager\DPortIO.sys [20112 2006-11-02] (Dritek System Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [264704 2006-04-06] (AVM GmbH)
R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-24 13:47 - 2013-12-24 13:47 - 00000000 _____ C:\Users\BEKS\Desktop\Antwort kopieren.txt
2013-12-23 20:12 - 2013-12-23 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 20:00 - 2013-12-23 20:05 - 00000000 ____D C:\AdwCleaner
2013-12-23 19:58 - 2013-12-24 13:14 - 00000000 ____D C:\Users\BEKS\Desktop\VirEntfernung
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-21 09:54 - 2013-12-21 10:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
==================== One Month Modified Files and Folders =======
2013-12-24 13:55 - 2013-03-03 12:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-24 13:47 - 2013-12-24 13:47 - 00000000 _____ C:\Users\BEKS\Desktop\Antwort kopieren.txt
2013-12-24 13:18 - 2007-10-23 17:15 - 01819515 _____ C:\Windows\WindowsUpdate.log
2013-12-24 13:14 - 2013-12-23 19:58 - 00000000 ____D C:\Users\BEKS\Desktop\VirEntfernung
2013-12-24 13:14 - 2006-11-02 11:33 - 01461736 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-24 13:07 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-24 13:07 - 2006-11-02 13:47 - 00003200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-24 13:06 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-23 22:57 - 2006-11-02 14:01 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-23 20:12 - 2013-12-23 20:12 - 00000000 ____D C:\Windows\ERUNT
2013-12-23 20:07 - 2006-11-02 13:47 - 00322712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-23 20:05 - 2013-12-23 20:00 - 00000000 ____D C:\AdwCleaner
2013-12-23 20:05 - 2009-09-16 16:03 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-12-23 16:53 - 2007-11-27 20:03 - 00076808 _____ C:\Users\BEKS\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-23 16:45 - 2013-12-23 16:45 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2013-12-23 16:45 - 2013-12-23 16:45 - 00000000 ____D C:\Program Files\TeamViewer
2013-12-21 10:37 - 2013-12-21 09:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-21 09:54 - 2013-12-21 09:54 - 00104664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-21 09:53 - 2013-12-21 09:53 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-21 09:51 - 2013-12-21 09:51 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-21 09:50 - 2013-12-21 09:50 - 00000000 ____D C:\Program Files\WinRAR
2013-12-21 09:39 - 2013-12-21 09:39 - 00000000 ____D C:\Users\BEKS\Desktop\Neuer Ordner
2013-12-21 09:35 - 2013-12-21 09:35 - 12582688 _____ (Malwarebytes Corp.) C:\Users\BEKS\Desktop\mbar-1.07..exe
2013-12-20 16:21 - 2013-12-20 16:21 - 00000000 ____D C:\FRST
2013-12-19 20:43 - 2013-12-19 20:43 - 00001354 _____ C:\Users\BEKS\Desktop\Neues Textdokument.txt
2013-12-19 20:04 - 2013-12-19 20:04 - 00000000 ____D C:\Program Files\ESET
2013-12-19 19:54 - 2013-09-08 11:24 - 00002654 _____ C:\Windows\PFRO.log
2013-12-19 19:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tapi
2013-12-17 15:21 - 2011-01-18 18:33 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-12-17 15:14 - 2008-08-09 11:11 - 00015176 _____ C:\Users\BEKS\AppData\Roaming\wklnhst.dat
2013-12-15 12:04 - 2013-08-15 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 12:03 - 2006-11-02 11:24 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-12-15 12:02 - 2013-08-29 08:57 - 00000000 ____D C:\Users\BEKS\AppData\Roaming\Yhbu
2013-12-13 21:55 - 2013-03-03 12:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-13 21:55 - 2013-03-03 12:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-28 21:13 - 2007-11-27 21:10 - 00045056 _____ C:\Users\BEKS\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Some content of TEMP:
====================
C:\Users\BEKS\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-24 13:13
==================== End Of Log ============================
--- --- --- |
| Themen zu MWB-fund:Trojan.Inject,Trojan. Ransomware und Spyware |
| appdata, befall, computer, entfernen, eset, gelöscht, hallo zusammen, infizierte, meldung, nichts, nutzen, online, quarantäne, scanner, sonntag, spyware, spyware.password, spyware.zbot.ed, system, temp, trojan.inject.rre, trojan.ransom.ed, windows |
Baum-Darstellung