| |
| |||||||
Log-Analyse und Auswertung: Trojaner auf C:\Users\Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
25.04.2014, 07:17
| #5 |
| |  Trojaner auf C:\Users\ So, müsste jetzt alles komplett haben. Als Antivirenprogramm habe ich normalerweise Comodo, welches die Datei auch ordnungsgemäß in Quarantäne gesetzt hat, wo ich sie ja nun unbedingt wieder herausholen und öffnen musste. Als ich gemerkt habe, welchen Bock ich da geschossen habe, hat mir Comodo nach einem kompletten Scan keine Funde mehr angezeigt. Hat sich wahrscheinlich gedacht, dass ich jetzt mal sehen soll, wie ich damit klarkomme wenn ich gegen seinen Rat handele ;-) Deshalb habe ich mir Antivir runtergeladen, um überhaupt erstmal was zu finden. Mit dem Anfangs geposteten Erfolg. Kurioserweise hat mir Antivir nach einem Systemneustart und einem erneuten Scan auch keine Funde mehr angezeigt. Habe Antivir wieder gelöscht. Ist eigentlich Antivir oder Comodo die bessere Antivirensoftware? Oder nimmt sich das nichts? Jetzt erstmal die Logdateien: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-04-2014 Ran by Spange at 2014-04-24 22:08:01 Run:1 Running from C:\Users\Spange\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** start 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Roaming\Ojudfjv 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Roaming\Icciymbh 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Roaming\Agrwniwhan 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Urdaptp 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Rqvrkfhf 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Oyyhnifs 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Oebnoulpg 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Ikue 2014-04-23 19:09 - 2014-04-23 19:09 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Gala 2014-04-23 19:07 - 2014-04-23 19:07 - 00000000 ____D () C:\ProgramData\nyjjb 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Roaming\Juqmrf 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Roaming\Faxy 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Roaming\Ddhpft 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Pujaqcq 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Pscuyj 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Pkepymum 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Lmdlebdt 2014-04-23 19:06 - 2014-04-23 19:06 - 00000000 ___HD () C:\Users\Spange\AppData\Local\Dkjtyx C:\Users\Spange\AppData\Local\Temp\*.exe AlternateDataStreams: C:\ProgramData\TEMP:3FF8C45D end ***************** C:\Users\Spange\AppData\Roaming\Ojudfjv => Moved successfully. C:\Users\Spange\AppData\Roaming\Icciymbh => Moved successfully. C:\Users\Spange\AppData\Roaming\Agrwniwhan => Moved successfully. C:\Users\Spange\AppData\Local\Urdaptp => Moved successfully. C:\Users\Spange\AppData\Local\Rqvrkfhf => Moved successfully. C:\Users\Spange\AppData\Local\Oyyhnifs => Moved successfully. C:\Users\Spange\AppData\Local\Oebnoulpg => Moved successfully. C:\Users\Spange\AppData\Local\Ikue => Moved successfully. C:\Users\Spange\AppData\Local\Gala => Moved successfully. C:\ProgramData\nyjjb => Moved successfully. C:\Users\Spange\AppData\Roaming\Juqmrf => Moved successfully. C:\Users\Spange\AppData\Roaming\Faxy => Moved successfully. C:\Users\Spange\AppData\Roaming\Ddhpft => Moved successfully. C:\Users\Spange\AppData\Local\Pujaqcq => Moved successfully. C:\Users\Spange\AppData\Local\Pscuyj => Moved successfully. C:\Users\Spange\AppData\Local\Pkepymum => Moved successfully. C:\Users\Spange\AppData\Local\Lmdlebdt => Moved successfully. C:\Users\Spange\AppData\Local\Dkjtyx => Moved successfully. "C:\Users\Spange\AppData\Local\Temp\*.exe" directory move: Could not move "C:\Users\Spange\AppData\Local\Temp\*.exe" directory. => Scheduled to move on reboot. C:\ProgramData\TEMP => ":3FF8C45D" ADS removed successfully. => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-04-24 22:11:12)<= "C:\Users\Spange\AppData\Local\Temp\*.exe" => Directory could not move. ==== End of Fixlog ====AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.202 - Bericht erstellt am 24/04/2014 um 22:28:29
# Aktualisiert 23/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Spange - SPANGE-PC
# Gestartet von : C:\Users\Spange\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Spange\AppData\Roaming\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\DSite
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\Users\Spange\AppData\Roaming\Mozilla\Firefox\Profiles\ffw3sibs.default\prefs.js ]
-\\ Google Chrome v34.0.1847.116
[ Datei : C:\Users\Spange\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [1801 octets] - [24/04/2014 22:27:12]
AdwCleaner[S0].txt - [1552 octets] - [24/04/2014 22:28:29]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1612 octets] ##########
Malwarebytes Anti-Malware Malwarebytes | Free Anti-Malware & Internet Security Software Suchlauf Datum: 24.04.2014 Suchlauf-Zeit: 23:28:57 Logdatei: mbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.24.09 Rootkit Datenbank: v2014.03.27.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Spange Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 264161 Verstrichene Zeit: 33 Min, 42 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 6 Trojan.Agent.ZT, C:\Users\Spange\AppData\Local\Temp\CD3D.tmp, In Quarantäne, [6898a25e1ce43ec2cf5690bd1ae71ee2], Spyware.Zbot.ED, C:\Users\Spange\AppData\Local\Temp\Evfynct\iraaudslns.exe, In Quarantäne, [639d966a30d0c13f1ff977f50ff2ec14], PUP.Optional.Delta.A, C:\Users\Spange\AppData\Local\Temp\is1590112554\DeltaTB.exe, In Quarantäne, [56aa22de0df3b0506e96946f3bc6e020], PUP.Optional.DealPly.A, C:\Users\Spange\AppData\Local\Temp\is1590112554\dp.exe, In Quarantäne, [9868cb35ab558c74f731bf962cd812ee], Spyware.Zbot.ED, C:\Users\Spange\AppData\Local\Temp\Nkqiy\uwlloqtslns.exe, In Quarantäne, [17e9b64ae21eb24ee830a9c37d8434cc], Spyware.Zbot.ED, C:\Users\Spange\AppData\Local\Temp\Rnroasc\mwrbkenslns.exe, In Quarantäne, [52ae669aac547c84cc4cbdaffe039f61], Physische Sektoren: 0 (No malicious items detected) (end) FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014 Ran by Spange (administrator) on SPANGE-PC on 25-04-2014 07:46:42 Running from C:\Users\Spange\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (AVM Berlin) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (Eastman Kodak Company) D:\Programme\Kodak Fotodrucker Papa\printer\center\KodakSvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe (FILSH Media GmbH) C:\Program Files (x86)\FILSHtray\FILSHtray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\javaw.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [6963744 2009-01-20] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-01-20] (Realtek Semiconductor Corp.) HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1612504 2013-11-11] (COMODO) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-08-13] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\runonceex: [] - HKU\S-1-5-21-1680386184-2619997045-1788842173-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2008-01-22] (Nero AG) HKU\S-1-5-21-1680386184-2619997045-1788842173-1001\...\Run: [HP Officejet 6700 (NET)] => C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FILSHtray.lnk ShortcutTarget: FILSHtray.lnk -> C:\Program Files (x86)\FILSHtray\FILSHtray.exe (FILSH Media GmbH) Startup: C:\Users\Spange\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login. HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2417A1ECBF7CCA01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Spange\AppData\Roaming\Mozilla\Firefox\Profiles\ffw3sibs.default FF Homepage: hxxp://www.google.de/|hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @pack.google.com/Google Updater;version=14 - C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: PrivDog - C:\Users\Spange\AppData\Roaming\Mozilla\Firefox\Profiles\ffw3sibs.default\Extensions\PrivDog@AdTrustMedia.com [2013-12-19] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-08-13] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-02] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-10-23] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR RestoreOnStartup: "hxxp://www.google.com/" CHR DefaultSearchURL: {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR Extension: (Google Wallet) - C:\Users\Spange\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-20] ==================== Services (Whitelisted) ================= R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6254152 2013-10-20] (COMODO) S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [164056 2013-09-24] (COMODO) R2 KodakSvc; D:\Programme\Kodak Fotodrucker Papa\printer\center\KodakSvc.exe [18944 2008-02-28] (Eastman Kodak Company) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG) R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [X] ==================== Drivers (Whitelisted) ==================== S3 61883; C:\Windows\System32\DRIVERS\61883.sys [60288 2009-07-14] (Microsoft Corporation) R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-09-24] (COMODO) R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [709144 2013-11-14] (COMODO) R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [48872 2013-09-24] (COMODO) R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH) S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2009-12-14] () R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [96800 2013-09-24] (COMODO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-25] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-25 07:46 - 2014-04-25 07:46 - 00011288 _____ () C:\Users\Spange\Desktop\FRST.txt 2014-04-24 23:38 - 2014-04-24 23:38 - 00001888 _____ () C:\Users\Spange\Desktop\mbam.txt 2014-04-24 22:53 - 2014-04-25 07:43 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-24 22:51 - 2014-04-24 22:51 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-24 22:51 - 2014-04-24 22:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-24 22:51 - 2014-04-24 22:51 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-24 22:51 - 2014-04-24 22:51 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-24 22:51 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-24 22:51 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-24 22:51 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-24 22:46 - 2014-04-24 22:46 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Spange\Desktop\mbam-setup-2.0.1.1004.exe 2014-04-24 22:31 - 2014-04-24 22:31 - 00001692 _____ () C:\Users\Spange\Desktop\AdwCleaner[S0].txt 2014-04-24 22:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-04-24 22:27 - 2014-04-24 22:28 - 00000000 ____D () C:\AdwCleaner 2014-04-24 22:23 - 2014-04-24 22:23 - 01365865 _____ () C:\Users\Spange\Desktop\adwcleaner.exe 2014-04-24 11:09 - 2014-04-24 11:09 - 00027654 _____ () C:\Users\Spange\Downloads\Addition.txt 2014-04-24 11:08 - 2014-04-24 11:30 - 00025905 _____ () C:\Users\Spange\Downloads\FRST.txt 2014-04-24 11:07 - 2014-04-25 07:46 - 00000000 ____D () C:\FRST 2014-04-24 11:07 - 2014-04-24 11:07 - 02061824 _____ (Farbar) C:\Users\Spange\Desktop\FRST64.exe 2014-04-24 08:55 - 2014-04-24 08:55 - 04472264 _____ (Avira Operations GmbH & Co. KG) C:\Users\Spange\Downloads\avira_en_av___ws.exe 2014-04-09 15:41 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-09 15:41 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-09 15:41 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-09 15:41 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-09 15:41 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-04-09 15:41 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2014-04-09 15:41 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2014-04-09 15:41 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2014-04-09 15:41 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2014-04-09 15:41 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2014-04-09 15:41 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-04-09 15:41 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2014-04-09 15:41 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2014-04-09 15:41 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2014-04-09 15:41 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2014-04-09 15:41 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-04-09 15:41 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys 2014-04-09 15:41 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys 2014-04-09 15:41 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll 2014-04-09 15:41 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll 2014-04-09 15:41 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys ==================== One Month Modified Files and Folders ======= 2014-04-25 07:47 - 2014-04-25 07:46 - 00011288 _____ () C:\Users\Spange\Desktop\FRST.txt 2014-04-25 07:46 - 2014-04-24 11:07 - 00000000 ____D () C:\FRST 2014-04-25 07:43 - 2014-04-24 22:53 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-25 07:41 - 2010-06-13 16:16 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-25 07:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-25 07:41 - 2009-07-14 06:51 - 00113119 _____ () C:\Windows\setupact.log 2014-04-24 23:41 - 2013-10-15 10:32 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat 2014-04-24 23:41 - 2009-12-14 15:09 - 01272075 _____ () C:\Windows\WindowsUpdate.log 2014-04-24 23:39 - 2009-07-14 06:45 - 00014800 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-24 23:39 - 2009-07-14 06:45 - 00014800 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-24 23:38 - 2014-04-24 23:38 - 00001888 _____ () C:\Users\Spange\Desktop\mbam.txt 2014-04-24 23:30 - 2009-12-14 16:30 - 00371152 _____ () C:\Windows\PFRO.log 2014-04-24 23:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help 2014-04-24 23:27 - 2010-06-13 16:16 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-24 23:04 - 2012-04-07 16:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-24 22:51 - 2014-04-24 22:51 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-24 22:51 - 2014-04-24 22:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-24 22:51 - 2014-04-24 22:51 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-24 22:51 - 2014-04-24 22:51 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-24 22:46 - 2014-04-24 22:46 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Spange\Desktop\mbam-setup-2.0.1.1004.exe 2014-04-24 22:31 - 2014-04-24 22:31 - 00001692 _____ () C:\Users\Spange\Desktop\AdwCleaner[S0].txt 2014-04-24 22:28 - 2014-04-24 22:27 - 00000000 ____D () C:\AdwCleaner 2014-04-24 22:23 - 2014-04-24 22:23 - 01365865 _____ () C:\Users\Spange\Desktop\adwcleaner.exe 2014-04-24 11:30 - 2014-04-24 11:08 - 00025905 _____ () C:\Users\Spange\Downloads\FRST.txt 2014-04-24 11:09 - 2014-04-24 11:09 - 00027654 _____ () C:\Users\Spange\Downloads\Addition.txt 2014-04-24 11:07 - 2014-04-24 11:07 - 02061824 _____ (Farbar) C:\Users\Spange\Desktop\FRST64.exe 2014-04-24 10:56 - 2010-06-13 16:15 - 00001034 _____ () C:\Windows\Tasks\Google Software Updater.job 2014-04-24 08:55 - 2014-04-24 08:55 - 04472264 _____ (Avira Operations GmbH & Co. KG) C:\Users\Spange\Downloads\avira_en_av___ws.exe 2014-04-24 08:41 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup 2014-04-24 08:40 - 2010-01-06 18:26 - 00000000 ____D () C:\Users\Spange\AppData\Local\Adobe 2014-04-24 08:39 - 2012-04-07 16:22 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-04-24 08:39 - 2012-04-07 16:22 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-04-24 08:39 - 2011-12-03 18:03 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-04-14 21:37 - 2010-08-26 20:49 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-04-14 16:02 - 2009-07-14 19:58 - 03794294 _____ () C:\Windows\system32\perfh007.dat 2014-04-14 16:02 - 2009-07-14 19:58 - 01110478 _____ () C:\Windows\system32\perfc007.dat 2014-04-14 16:02 - 2009-07-14 07:13 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-09 18:04 - 2013-08-14 21:25 - 00000000 ____D () C:\Windows\system32\MRT 2014-04-09 18:03 - 2009-12-14 20:33 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-04-03 09:51 - 2014-04-24 22:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-24 22:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-24 22:51 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-02 19:22 - 2010-06-13 16:16 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-04-02 19:22 - 2010-06-13 16:16 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-31 03:16 - 2014-04-09 15:41 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-31 03:13 - 2014-04-09 15:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-31 02:13 - 2014-04-09 15:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-31 01:57 - 2014-04-09 15:41 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-30 20:05 - 2010-03-19 20:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox Some content of TEMP: ==================== C:\Users\Spange\AppData\Local\Temp\7.6.20.1-EasyShrx.Dll C:\Users\Spange\AppData\Local\Temp\AskSLib.dll C:\Users\Spange\AppData\Local\Temp\avgnt.exe C:\Users\Spange\AppData\Local\Temp\BingBarSetup-Partner.exe C:\Users\Spange\AppData\Local\Temp\CmdLineExt03.dll C:\Users\Spange\AppData\Local\Temp\E~NSISu_.exe C:\Users\Spange\AppData\Local\Temp\FileSystemView.dll C:\Users\Spange\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe C:\Users\Spange\AppData\Local\Temp\iv_uninstall.exe C:\Users\Spange\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u19-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe C:\Users\Spange\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe C:\Users\Spange\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\Spange\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Spange\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe C:\Users\Spange\AppData\Local\Temp\jre-7u40-windows-i586-iftw.exe C:\Users\Spange\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Spange\AppData\Local\Temp\Quarantine.exe C:\Users\Spange\AppData\Local\Temp\SIntf16.dll C:\Users\Spange\AppData\Local\Temp\SIntf32.dll C:\Users\Spange\AppData\Local\Temp\SIntfNT.dll C:\Users\Spange\AppData\Local\Temp\update-0.11.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-21 18:29 ==================== End Of Log ============================ |
| Themen zu Trojaner auf C:\Users\ |
| anhang, anwendung, appdata, fund, gestern, microsoft, ms-dos anwendung, pup.optional.dealply.a, pup.optional.delta.a, quarantine, quarantäne, spyware.zbot.ed, temp, tr/crypt.zpack.65462trojan, troja, trojan.agent.zt, users, version, win32/injector.bcli, win32/kryptik.bwjc, windows, öffnen |
Baum-Darstellung