| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Crypt.EPACK.41609 in C:\ProgramData\3UXYpqrz.exeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
09.02.2014, 22:39
| #1 |
| |  TR/Crypt.EPACK.41609 in C:\ProgramData\3UXYpqrz.exe Hallo, ohne länger darauf einzugehen, wie dumm ich mir vorkomme, und wie sehr ich mich über mich selbst ärgere, hier der Bericht zum Problem mit der Bitte um eure Hilfe: Ich habe eine Email geöffnet (schien meine Telekom-Abrechnung zu enthalten) und im Word-Dokument das dort enthaltene Icon doppelt angeklickt (Ja, ich weiß…). Daraufhin hat sich umgehend ein Fenster geöffnet, mit der Aufforderung im folgenden Windows Fenster auf „Aktion erlauben“ zu klicken. Als dann das Windows Fenster kam, habe ich immer auf „nicht erlauben“ geklickt. Sofort habe ich Avira gestartet. Dieser hat zwei (gleiche) Funde gemeldet: TR/Crypt.EPACK.41609 in C:\ProgramData\3UXYpqrz.exe und diese in Quarantäne verschoben. Nach dem ersten Fund kam dann kein Windows-Fenster mehr, nach dem zweiten Fund kam auch das erste „Erklärungs-Fenster“ nicht mehr. An und für sich hatte ich danach keine auffälligen Probleme, wollte mich aber auf jeden Fall über den Trojaner schlau machen und bin auf dieses Forum gestoßen. Was ich nicht herausfinden konnte war, was dieser Virus eigentlich macht? Wichtiger aber wäre mir noch zu wissen, ob Anti Vir erfolgreich war, und ob ich mich sicher fühlen kann, oder ob da noch etwas schlummert. Ich hatte seither das Gefühl, dass der PC langsamer hochfährt – kann aber sein, dass das eine „eingebildete Krankheit“ ist – ich bin mir nicht sicher. Habe die Anleitung für die Erstellung eines „Hilfeschreis“ gelesen und alle Schritte durchgeführt. Dann habe ich begonnen diesen Eintrag zu erstellen, und plötzlich ist der Bildschirm schwarz geworden. Sofort darauf kam ein blauer Bildschirm mit der Meldung, dass Windows einen Fehler hat und sicherheitshalber beendet wurde. Danach konnte ich den PC normal hochfahren. Mache mir jetzt aber noch mehr Sorgen (ist noch nie passiert) – vielen lieben Dank schon einmal für eure Hilfe! LG Bettina Hier der FIRST Scan, und GMER als Anhang (Avir Log File war leider zu groß) FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-02-2014 02
Ran by Bettina (administrator) on BETTINAS-VAIO on 09-02-2014 21:46:45
Running from C:\Users\Bettina\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AuthenTec, Inc) C:\Program Files\TrueSuite\TrueSuite.Service.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Uniblue Systems Ltd) C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(AuthenTec Inc.) C:\Program Files\TrueSuite\TrueSuite.TouchControl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESGfxMgr.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(AuthenTec, Inc.) C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe
(AuthenTec, Inc.) C:\Program Files\TrueSuite\x86\TrueSuite.ClientAppLogonExe.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Download Beast) C:\Program Files (x86)\Download Beast\DownloadBeast.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpWareSE4.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAdmin.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13320808 2011-11-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2278504 2011-11-11] (Realtek Semiconductor)
HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10372368 2011-07-12] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2772264 2011-06-15] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-09-16] (Adobe Systems Incorporated)
HKLM\...\Run: [ClientAppLogon] - C:\Program Files\TrueSuite\TrueSuite.ClientAppLogonExe.exe [421192 2011-04-26] (AuthenTec, Inc.)
HKLM\...\Run: [ClientAppLogon32] - C:\Program Files\TrueSuite\x86\TrueSuite.ClientAppLogonExe.exe [308040 2011-04-26] (AuthenTec, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2710856 2009-11-02] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [2801288 2011-05-31] (Sony Corporation)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [38984 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840768 2013-05-10] (Adobe Systems Inc.)
HKLM-x32\...\Run: [SSBkgdUpdate] - C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [OpwareSE4] - C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe [79400 2007-02-04] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2123607189-1062536604-632316293-1000\...\Run: [EA Core] - "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-2123607189-1062536604-632316293-1000\...\Run: [download beast] - C:\Program Files (x86)\Download Beast\DownloadBeast.exe [3891712 2012-06-20] (Download Beast)
HKU\S-1-5-21-2123607189-1062536604-632316293-1000\...\Run: [Spybot-S&D Cleaning] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)
HKU\S-1-5-21-2123607189-1062536604-632316293-1000\...\MountPoints2: {6db70886-8b38-11e3-b8f3-f0bf97cee46e} - F:\HPLauncher.exe
HKU\S-1-5-21-2123607189-1062536604-632316293-1000\...\MountPoints2: {7b0fa1fe-443f-11e1-8a8e-806e6f6e6963} - D:\Autorun.exe
HKU\S-1-5-21-2123607189-1062536604-632316293-1000\...\MountPoints2: {d4501572-7c42-11e2-be71-f0bf97cee46e} - E:\PMCsetup.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://sony.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKCU - {0B436716-F63E-40C3-A76A-AB64CCB5A0C4} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {DD7A9FCD-6B33-44F6-831F-2C5843AAA3D5} URL = hxxp://rover.ebay.com/rover/1/5221-29898-16445-29/4?mpre=hxxp://shop.ebay.at/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
BHO: TrueSuite WebStore - {5cb2b77d-c8ca-44db-af20-a7a4df462a12} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files\TrueSuite\TrueSuite.IEBHO.dll (AuthenTec Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: TrueSuite WebStore - {5cb2b77d-c8ca-44db-af20-a7a4df462a12} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files\TrueSuite\x86\TrueSuite.IEBHO.dll (AuthenTec Inc.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Softonic Helper Object - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\Softonic\1.5.24.3\bh\Softonic.dll (Softonic.com)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.5.24.3\SoftonicTlbr.dll (Softonic.com)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
FireFox:
========
FF ProfilePath: C:\Users\Bettina\AppData\Roaming\Mozilla\Firefox\Profiles\8wwz8bg0.default
FF user.js: detected! => C:\Users\Bettina\AppData\Roaming\Mozilla\Firefox\Profiles\8wwz8bg0.default\user.js
FF DefaultSearchEngine: Wikipedia (de)
FF SelectedSearchEngine: Wikipedia (de)
FF Homepage: hxxp://www.google.at/
FF Keyword.URL: hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=801f34d400000000000088532e39ccdc&tlver=1.6.4.6&instlRef=std&babTrack&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DivX Web Player - C:\Users\Bettina\AppData\Roaming\Mozilla\Firefox\Profiles\8wwz8bg0.default\Extensions\DivXWebPlayer@divx.com.xpi [2012-02-07]
FF Extension: Ciuvo - C:\Users\Bettina\AppData\Roaming\Mozilla\Firefox\Profiles\8wwz8bg0.default\Extensions\extension@ciuvo.com.xpi [2012-01-22]
FF Extension: TrueSuite Website Log On - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon_toolbar@truesuite.com [2014-02-09]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011-08-29]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [oiokdoppleiafjmfmggefbkghfblaplo] - C:\Program Files\TrueSuite\x86\tschrome.crx [2010-11-29]
==================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-28] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
S3 DCDhcpService; C:\Program Files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [111776 2011-08-25] (Atheros Communication Inc.)
R2 FPLService; C:\Program Files\TrueSuite\TrueSuite.Service.exe [294216 2011-04-26] (AuthenTec, Inc)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [199272 2011-07-05] (Realtek Semiconductor)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [260768 2011-11-30] (Sony Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1368624 2013-08-01] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-28] (Avira Operations GmbH & Co. KG)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-09 21:46 - 2014-02-09 21:47 - 00020245 _____ () C:\Users\Bettina\Desktop\FRST.txt
2014-02-09 21:46 - 2014-02-09 21:46 - 00000000 ____D () C:\FRST
2014-02-09 21:45 - 2014-02-09 21:46 - 02170880 _____ (Farbar) C:\Users\Bettina\Desktop\FRST64.exe
2014-02-09 21:44 - 2014-02-09 21:44 - 00000476 _____ () C:\Users\Bettina\Desktop\defogger_disable.log
2014-02-09 21:44 - 2014-02-09 21:44 - 00000000 _____ () C:\Users\Bettina\defogger_reenable
2014-02-09 21:42 - 2014-02-09 21:42 - 00050477 _____ () C:\Users\Bettina\Desktop\Defogger.exe
2014-02-07 14:51 - 2014-02-07 14:51 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-07 14:51 - 2014-02-07 14:51 - 00000000 ____D () C:\Users\Bettina\AppData\Roaming\Malwarebytes
2014-02-07 14:51 - 2014-02-07 14:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-07 14:51 - 2014-02-07 14:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-07 14:51 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-07 14:50 - 2014-02-07 14:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bettina\Desktop\Documents\mbam-setup-1.75.0.1300.exe
2014-02-07 14:00 - 2014-02-07 14:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-07 13:59 - 2014-02-07 13:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-07 13:59 - 2014-02-07 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-07 13:59 - 2014-02-07 13:59 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-07 13:59 - 2014-02-07 13:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-07 13:58 - 2014-02-07 13:58 - 00921000 _____ (Oracle Corporation) C:\Users\Bettina\Desktop\Documents\jxpiinstall.exe
2014-02-07 13:58 - 2014-02-07 13:58 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-06 21:16 - 2014-02-07 13:54 - 00000000 ____D () C:\Users\Bettina\AppData\Local\NPE
2014-02-06 21:16 - 2014-02-06 21:16 - 03057128 ____N (Symantec Corporation) C:\Users\Bettina\Desktop\Documents\NPE.exe
2014-02-06 21:16 - 2014-02-06 21:16 - 00000000 ____D () C:\ProgramData\Norton
2014-02-06 21:15 - 2014-02-06 21:15 - 02989560 _____ (Symantec Corporation) C:\Users\Bettina\Desktop\Documents\NPE32.exe
2014-02-05 22:54 - 2014-02-05 22:54 - 00008581 _____ () C:\Windows\wininit.ini
2014-02-05 20:08 - 2014-02-05 20:08 - 03544968 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-01-16 17:46 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-16 17:46 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-16 17:46 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-16 17:46 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-16 17:46 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-16 17:46 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-16 17:46 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-16 17:46 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-16 17:46 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-11 14:37 - 2014-01-11 14:37 - 00000000 ____D () C:\ProgramData\Qualcomm Atheros
==================== One Month Modified Files and Folders =======
2014-02-09 21:47 - 2014-02-09 21:46 - 00020245 _____ () C:\Users\Bettina\Desktop\FRST.txt
2014-02-09 21:46 - 2014-02-09 21:46 - 00000000 ____D () C:\FRST
2014-02-09 21:46 - 2014-02-09 21:45 - 02170880 _____ (Farbar) C:\Users\Bettina\Desktop\FRST64.exe
2014-02-09 21:44 - 2014-02-09 21:44 - 00000476 _____ () C:\Users\Bettina\Desktop\defogger_disable.log
2014-02-09 21:44 - 2014-02-09 21:44 - 00000000 _____ () C:\Users\Bettina\defogger_reenable
2014-02-09 21:44 - 2012-01-21 17:00 - 00000000 ____D () C:\Users\Bettina
2014-02-09 21:42 - 2014-02-09 21:42 - 00050477 _____ () C:\Users\Bettina\Desktop\Defogger.exe
2014-02-09 21:42 - 2013-03-04 20:14 - 00000307 _____ () C:\Users\Bettina\Desktop\Neues Textdokument (2).txt
2014-02-09 21:39 - 2009-07-14 05:45 - 00020944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-09 21:39 - 2009-07-14 05:45 - 00020944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-09 21:36 - 2011-08-29 23:01 - 00696870 _____ () C:\Windows\system32\perfh007.dat
2014-02-09 21:36 - 2011-08-29 23:01 - 00148134 _____ () C:\Windows\system32\perfc007.dat
2014-02-09 21:36 - 2009-07-14 06:13 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-09 21:35 - 2012-01-21 16:59 - 01771974 _____ () C:\Windows\WindowsUpdate.log
2014-02-09 21:30 - 2013-03-20 20:31 - 00000344 _____ () C:\Windows\Tasks\dsmonitor.job
2014-02-09 21:29 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-09 21:29 - 2009-07-14 05:51 - 00101649 _____ () C:\Windows\setupact.log
2014-02-07 16:08 - 2012-04-05 14:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-07 14:51 - 2014-02-07 14:51 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-07 14:51 - 2014-02-07 14:51 - 00000000 ____D () C:\Users\Bettina\AppData\Roaming\Malwarebytes
2014-02-07 14:51 - 2014-02-07 14:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-07 14:51 - 2014-02-07 14:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-07 14:50 - 2014-02-07 14:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bettina\Desktop\Documents\mbam-setup-1.75.0.1300.exe
2014-02-07 14:00 - 2014-02-07 14:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-07 13:59 - 2014-02-07 13:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-07 13:59 - 2014-02-07 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-07 13:59 - 2014-02-07 13:59 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-07 13:59 - 2014-02-07 13:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-07 13:58 - 2014-02-07 13:58 - 00921000 _____ (Oracle Corporation) C:\Users\Bettina\Desktop\Documents\jxpiinstall.exe
2014-02-07 13:58 - 2014-02-07 13:58 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-07 13:54 - 2014-02-06 21:16 - 00000000 ____D () C:\Users\Bettina\AppData\Local\NPE
2014-02-06 21:16 - 2014-02-06 21:16 - 03057128 ____N (Symantec Corporation) C:\Users\Bettina\Desktop\Documents\NPE.exe
2014-02-06 21:16 - 2014-02-06 21:16 - 00000000 ____D () C:\ProgramData\Norton
2014-02-06 21:15 - 2014-02-06 21:15 - 02989560 _____ (Symantec Corporation) C:\Users\Bettina\Desktop\Documents\NPE32.exe
2014-02-06 07:09 - 2012-06-03 15:42 - 00000000 ____D () C:\SMBX
2014-02-06 07:04 - 2010-11-21 04:47 - 00188412 _____ () C:\Windows\PFRO.log
2014-02-05 22:54 - 2014-02-05 22:54 - 00008581 _____ () C:\Windows\wininit.ini
2014-02-05 22:16 - 2013-12-09 20:55 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-02-05 20:08 - 2014-02-05 20:08 - 03544968 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-05 20:08 - 2012-04-05 14:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-05 20:08 - 2012-04-05 14:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-05 20:08 - 2011-08-29 13:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-21 18:57 - 2012-01-21 17:01 - 00000000 ____D () C:\Users\Bettina\AppData\Local\Adobe
2014-01-17 03:21 - 2009-07-14 05:45 - 00361232 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-17 03:04 - 2013-08-09 02:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-17 03:01 - 2012-02-05 12:48 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 03:28 - 2012-01-21 17:13 - 00000000 ____D () C:\Update
2014-01-15 03:09 - 2012-02-11 17:42 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-11 14:37 - 2014-01-11 14:37 - 00000000 ____D () C:\ProgramData\Qualcomm Atheros
2014-01-11 14:37 - 2011-08-29 13:13 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
Some content of TEMP:
====================
C:\Users\Bettina\AppData\Local\Temp\avgnt.exe
C:\Users\Bettina\AppData\Local\Temp\ose00000.exe
C:\Users\Bettina\AppData\Local\Temp\RSPUpgradeInstaller.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-05 18:49
==================== End Of Log ============================
--- --- --- Geändert von bettina.ka (09.02.2014 um 23:38 Uhr) |
| Themen zu TR/Crypt.EPACK.41609 in C:\ProgramData\3UXYpqrz.exe |
| antivir, avira, bildschirm, bingbar, browser, canon, email, fehler, firefox, flash player, homepage, installation, log file, mozilla, object, problem, realtek, registry, scan, services.exe, software, svchost.exe, symantec, system, trojaner, virus, windows |
Baum-Darstellung