|
Plagegeister aller Art und deren Bekämpfung: Avira meldet Crypted.GenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
04.06.2014, 12:00 | #1 |
| Avira meldet Crypted.Gen Hallo ich hoffe mir kann jemand helfen. Habe meinen Laptop vor 3 Wochen neu Aufgespielt weil ich da schon Probleme hatte, es wurde alles neu drauf aber meine Festplatte von 414 GB zeigt nur 214 frei an. Komisch bei neu Instalation. Wenn ich es nochmal versuche komme ich nicht zu den Partitionen. Habe auch nicht besonders viel Ahnung von Computer. Seit heute meldet sich ständig Avira und sagt Crypted.Gen in einem anderen Beitrag hatte ich gelesen man soll Combofix runter laden und Ausführen, dies habe ich gemacht hier das Ergebnis: Combofix Logfile: Code:
ATTFilter ComboFix 14-06-03.01 - CF 04.06.2014 12:10:27.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3497.2399 [GMT 2:00] ausgeführt von:: c:\users\CF\Downloads\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859} SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Neuer Wiederherstellungspunkt wurde erstellt . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\CF\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0.localstorage c:\users\CF\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_klhlfdbffplhpkpalkmacjejfbdeefaj_0.localstorage c:\users\CF\AppData\Local\Google\Chrome\User Data\Default\Preferences c:\users\CF\AppData\Local\nss7EE.tmp c:\users\CF\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll . . ((((((((((((((((((((((( Dateien erstellt von 2014-05-04 bis 2014-06-04 )))))))))))))))))))))))))))))) . . 2014-06-04 07:16 . 2014-06-04 07:16 -------- d-----w- c:\users\CF\AppData\Roaming\Optimizer Pro 2014-06-04 07:11 . 2014-06-04 07:11 -------- d-----w- c:\users\CF\AppData\Roaming\0D0S1L2Z1P1B 2014-06-04 07:11 . 2014-06-04 07:11 -------- d-----w- c:\program files\coupon downloader 2014-06-04 07:10 . 2014-06-04 07:10 -------- d-----w- c:\program files\Optimizer Pro 2014-06-04 07:10 . 2014-06-04 07:10 -------- d-----w- c:\program files\004 2014-06-04 07:10 . 2014-06-04 07:10 -------- d-----w- c:\program files\OpenIt 2014-06-04 06:44 . 2014-06-04 06:44 -------- d-----w- c:\programdata\PriceMeterLiveUpdate 2014-06-04 06:44 . 2014-06-04 06:44 -------- d-----w- c:\program files\PriceMeterLiveUpdate 2014-06-04 06:44 . 2014-06-04 07:15 -------- d-----w- c:\users\CF\AppData\Local\PriceMeter 2014-06-04 06:43 . 2014-06-04 06:43 -------- d-----w- c:\program files\Buzz-it-soft 2014-06-04 06:43 . 2014-06-04 06:43 -------- d-----w- c:\program files\RegClean Pro 2014-05-25 19:01 . 2014-05-25 19:01 -------- d-----w- c:\program files\CdCoverCreator 2014-05-23 18:42 . 2014-05-22 16:25 52928 ----a-w- c:\windows\system32\drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}w.sys 2014-05-23 18:36 . 2014-05-23 18:36 -------- d-----w- c:\program files\Check Point Software Technologies LTD 2014-05-23 18:36 . 2014-05-23 18:36 -------- d-----w- c:\users\CF\AppData\Roaming\Check Point Software Technologies LTD 2014-05-23 18:35 . 2014-05-23 18:35 -------- d-----w- c:\program files\CheckPoint 2014-05-23 18:35 . 2014-05-23 18:35 -------- d-----w- c:\programdata\CheckPoint 2014-05-23 18:34 . 2014-05-23 18:34 -------- d-----w- c:\users\CF\AppData\Roaming\TuneUp Software 2014-05-23 18:34 . 2014-05-23 18:34 -------- d-----w- c:\users\CF\AppData\Local\TuneUp Software 2014-05-23 18:33 . 2014-05-23 18:35 -------- d-----w- c:\programdata\TuneUp Software 2014-05-23 18:32 . 2014-05-23 18:33 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-23 18:32 . 2014-05-23 18:32 -------- d--h--w- c:\programdata\Common Files 2014-05-23 18:31 . 2014-05-25 17:32 -------- d-----w- c:\program files\DVDVideoSoft 2014-05-23 18:31 . 2014-05-25 17:32 -------- d-----w- c:\program files\Common Files\DVDVideoSoft 2014-05-23 18:31 . 2014-05-23 18:31 -------- d-----w- c:\users\CF\AppData\Roaming\OpenCandy 2014-05-23 18:30 . 2014-05-25 17:32 -------- d-----w- c:\users\CF\AppData\Roaming\DVDVideoSoft 2014-05-23 17:33 . 2014-05-23 17:33 -------- d-----w- c:\users\CF\AppData\Roaming\vlc 2014-05-23 17:30 . 2014-05-23 17:30 -------- d-----w- c:\programdata\Systweak 2014-05-23 17:30 . 2014-05-23 17:31 -------- d-----w- c:\program files\Advanced System Protector 2014-05-23 17:30 . 2012-07-25 10:03 17136 ----a-w- c:\windows\system32\sasnative32.exe 2014-05-23 17:30 . 2014-06-04 06:43 -------- d-----w- c:\users\CF\AppData\Roaming\Systweak 2014-05-23 17:30 . 2013-08-22 16:36 18776 ----a-w- c:\windows\system32\roboot.exe 2014-05-23 17:14 . 2014-06-04 06:45 -------- d-----w- c:\program files\VideoLAN 2014-05-23 17:12 . 2014-05-23 17:12 -------- d-----w- c:\program files\rrsavings 2014-05-23 17:12 . 2014-05-23 17:12 -------- d-----w- c:\program files\002 2014-05-23 17:11 . 2014-05-24 10:02 -------- d-----w- c:\program files\ConstaSurf 2014-05-23 17:10 . 2014-05-23 17:10 -------- d-----w- c:\users\CF\AppData\Local\SearchProtect 2014-05-23 17:10 . 2014-06-02 11:02 -------- d-----w- c:\program files\SearchProtect 2014-05-21 17:57 . 2014-05-21 17:57 -------- d-----w- c:\users\CF\AppData\Local\Opera Software 2014-05-21 17:57 . 2014-05-21 17:57 -------- d-----w- c:\users\CF\AppData\Roaming\Opera Software 2014-05-21 17:56 . 2014-05-21 17:57 -------- d-----w- c:\program files\Opera 2014-05-21 07:13 . 2014-05-21 07:13 -------- d-----w- c:\users\CF\AppData\Roaming\IrfanView 2014-05-19 20:10 . 2014-05-19 20:10 -------- d-----w- c:\programdata\Sony 2014-05-19 20:10 . 2014-05-19 20:10 -------- d-----w- c:\program files\Sony 2014-05-19 12:33 . 2014-05-19 12:34 -------- d-----w- c:\users\CF\AppData\Local\Facebook 2014-05-15 22:35 . 2014-05-06 03:07 2724864 ----a-w- c:\windows\system32\mshtml.tlb 2014-05-14 18:30 . 2014-05-14 18:30 -------- d-----w- c:\users\CF\Tracing 2014-05-14 15:43 . 2014-05-14 15:43 -------- d-----w- c:\windows\de 2014-05-14 15:42 . 2014-05-14 15:42 -------- dc----w- c:\windows\system32\DRVSTORE 2014-05-14 15:42 . 2014-03-31 19:36 49856 ----a-w- c:\windows\system32\drivers\fssfltr.sys 2014-05-14 15:42 . 2014-05-14 15:42 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition 2014-05-14 15:41 . 2014-05-14 15:41 -------- d-----w- c:\windows\PCHEALTH 2014-05-14 15:40 . 2014-05-14 15:42 -------- d-----w- c:\program files\Windows Live 2014-05-14 15:39 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll 2014-05-14 15:39 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll 2014-05-14 15:39 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll 2014-05-14 15:39 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll 2014-05-14 15:38 . 2009-09-04 15:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll 2014-05-14 15:38 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2014-05-14 15:37 . 2014-05-14 15:37 -------- d-----w- c:\program files\Microsoft OneDrive 2014-05-14 15:37 . 2014-05-14 15:37 -------- d-----r- c:\users\CF\OneDrive 2014-05-14 15:37 . 2014-05-14 15:37 -------- d-----w- c:\programdata\Microsoft OneDrive 2014-05-14 15:36 . 2014-05-23 21:12 -------- d-----w- c:\users\CF\AppData\Local\Windows Live 2014-05-14 15:32 . 2014-05-14 15:32 -------- d-----w- c:\program files\Common Files\Windows Live 2014-05-13 11:21 . 2014-05-13 11:21 -------- d-----w- c:\program files\Uninstaller 2014-05-13 11:20 . 2014-05-13 11:20 -------- d-----w- c:\users\CF\AppData\Roaming\Optimizer Elite Max 2014-05-13 11:16 . 2014-05-13 17:49 -------- d-----w- c:\users\CF\AppData\Local\newplayer 2014-05-13 11:16 . 2014-05-13 17:49 -------- d-----w- c:\program files\NewPlayer 2014-05-13 11:15 . 2014-05-13 11:15 -------- d-----w- c:\users\CF\AppData\Roaming\Activeris 2014-05-13 11:15 . 2014-05-13 11:15 -------- d-----w- c:\programdata\Activeris 2014-05-13 11:15 . 2014-05-13 17:49 -------- d-----w- c:\program files\Activeris AntiMalware 2014-05-13 11:15 . 2014-05-13 17:49 -------- d-----w- c:\program files\Optimizer Elite Max 2014-05-13 10:47 . 2014-05-13 17:49 -------- d-----w- c:\program files\MediaPlayerplus 2014-05-13 10:47 . 2014-06-04 06:44 -------- d-----w- c:\program files\MyPC Backup 2014-05-13 10:46 . 2014-05-13 17:49 -------- d-----w- c:\program files\AnyProtectEx 2014-05-13 10:46 . 2014-05-24 10:02 -------- d-----w- c:\users\CF\AppData\Roaming\VOPackage 2014-05-13 10:45 . 2014-05-13 10:45 -------- d-----w- c:\users\CF\AppData\Local\globalUpdate 2014-05-13 10:45 . 2014-05-13 10:45 -------- d-----w- c:\program files\globalUpdate 2014-05-13 10:45 . 2014-05-13 22:45 -------- d-----w- c:\program files\HQ-Video-Pro-1.9 2014-05-13 10:45 . 2014-05-13 17:49 -------- d-----w- c:\program files\Re-markit-soft 2014-05-11 19:28 . 2014-05-11 19:28 -------- d-----w- c:\program files\PMlabs 2014-05-11 19:22 . 2014-05-13 17:49 -------- d-----w- c:\users\CF\AppData\Local\gtk-2.0 2014-05-11 19:19 . 2014-05-11 19:19 -------- d-----w- c:\users\CF\AppData\Local\fontconfig 2014-05-11 19:19 . 2014-05-11 19:22 -------- d-----w- c:\users\CF\.gimp-2.8 2014-05-11 19:19 . 2014-05-11 19:19 -------- d-----w- c:\users\CF\AppData\Local\gegl-0.2 2014-05-11 19:16 . 2014-05-11 19:18 -------- d-----w- c:\program files\GIMP 2 2014-05-11 19:02 . 2014-05-21 07:13 -------- d-----w- c:\program files\IrfanView 2014-05-11 18:53 . 2014-05-11 18:53 -------- d-----w- c:\users\CF\AppData\Roaming\SupTab 2014-05-11 18:53 . 2014-06-04 07:11 -------- d-----w- c:\programdata\IePluginServices 2014-05-11 18:53 . 2014-06-04 07:11 -------- d-----w- c:\program files\SupTab 2014-05-11 18:53 . 2014-06-04 07:11 -------- d-----w- c:\programdata\WPM 2014-05-11 18:53 . 2014-05-13 17:50 -------- d-----w- c:\program files\webget 2014-05-11 18:52 . 2014-06-04 07:11 -------- d-----w- c:\users\CF\AppData\Roaming\sweet-page 2014-05-11 18:52 . 2014-05-11 18:52 -------- d-----w- c:\users\CF\AppData\Roaming\DigitalSites 2014-05-06 23:06 . 2014-05-16 05:06 -------- d-s---w- c:\windows\system32\CompatTel . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-05-22 09:31 . 2014-04-09 11:31 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys 2014-05-22 09:31 . 2014-04-09 11:31 93528 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2014-05-14 20:34 . 2014-04-10 16:06 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-05-14 20:34 . 2014-04-10 16:06 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-05-14 15:41 . 2012-07-17 12:37 23264 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2014-04-16 22:59 . 2014-04-16 22:59 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2014-04-16 22:59 . 2014-04-16 22:59 645120 ----a-w- c:\windows\system32\jsIntl.dll 2014-04-16 22:59 . 2014-04-16 22:59 62464 ----a-w- c:\windows\system32\tdc.ocx 2014-04-16 22:59 . 2014-04-16 22:59 337408 ----a-w- c:\windows\system32\html.iec 2014-04-16 22:59 . 2014-04-16 22:59 194048 ----a-w- c:\windows\system32\elshyph.dll 2014-04-16 22:59 . 2014-04-16 22:59 182272 ----a-w- c:\windows\system32\msls31.dll 2014-04-16 22:59 . 2014-04-16 22:59 61952 ----a-w- c:\windows\system32\MshtmlDac.dll 2014-04-16 22:59 . 2014-04-16 22:59 36352 ----a-w- c:\windows\system32\imgutil.dll 2014-04-16 22:59 . 2014-04-16 22:59 24576 ----a-w- c:\windows\system32\licmgr10.dll 2014-04-16 22:59 . 2014-04-16 22:59 151552 ----a-w- c:\windows\system32\iexpress.exe 2014-04-16 22:59 . 2014-04-16 22:59 139264 ----a-w- c:\windows\system32\wextract.exe 2014-04-16 22:59 . 2014-04-16 22:59 13312 ----a-w- c:\windows\system32\mshta.exe 2014-04-16 22:59 . 2014-04-16 22:59 111616 ----a-w- c:\windows\system32\IEAdvpack.dll 2014-04-16 22:59 . 2014-04-16 22:59 1051136 ----a-w- c:\windows\system32\mshtmlmedia.dll 2014-04-16 22:59 . 2014-04-16 22:59 86016 ----a-w- c:\windows\system32\iesysprep.dll 2014-04-16 22:59 . 2014-04-16 22:59 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2014-04-16 22:59 . 2014-04-16 22:59 48640 ----a-w- c:\windows\system32\mshtmler.dll 2014-04-16 11:23 . 2014-04-16 11:23 49152 ----a-w- c:\windows\system32\taskhost.exe 2014-04-16 11:23 . 2014-04-16 11:23 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 906240 ----a-w- c:\windows\system32\FntCache.dll 2014-04-16 11:23 . 2014-04-16 11:23 604160 ----a-w- c:\windows\system32\d3d10level9.dll 2014-04-16 11:23 . 2014-04-16 11:23 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll 2014-04-16 11:23 . 2014-04-16 11:23 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 293376 ----a-w- c:\windows\system32\dxgi.dll 2014-04-16 11:23 . 2014-04-16 11:23 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-04-16 11:23 . 2014-04-16 11:23 249856 ----a-w- c:\windows\system32\d3d10_1core.dll 2014-04-16 11:23 . 2014-04-16 11:23 2284544 ----a-w- c:\windows\system32\msmpeg2vdec.dll 2014-04-16 11:23 . 2014-04-16 11:23 220160 ----a-w- c:\windows\system32\d3d10core.dll 2014-04-16 11:23 . 2014-04-16 11:23 207872 ----a-w- c:\windows\system32\WindowsCodecsExt.dll 2014-04-16 11:23 . 2014-04-16 11:23 187392 ----a-w- c:\windows\system32\UIAnimation.dll 2014-04-16 11:23 . 2014-04-16 11:23 161792 ----a-w- c:\windows\system32\d3d10_1.dll 2014-04-16 11:23 . 2014-04-16 11:23 1247744 ----a-w- c:\windows\system32\DWrite.dll 2014-04-16 11:23 . 2014-04-16 11:23 1158144 ----a-w- c:\windows\system32\XpsPrint.dll 2014-04-16 11:23 . 2014-04-16 11:23 1080832 ----a-w- c:\windows\system32\d3d10.dll 2014-04-16 11:23 . 2014-04-16 11:23 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-04-16 11:20 . 2014-04-16 11:20 1505280 ----a-w- c:\windows\system32\d3d11.dll 2014-04-14 13:15 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll 2014-04-09 18:23 . 2014-04-09 18:23 69240 ----a-w- c:\windows\system32\drivers\avnetflt.sys 2014-03-31 19:41 . 2014-03-31 19:41 58568 ----a-w- c:\windows\system32\sirenacm.dll 2014-03-31 19:34 . 2014-03-31 19:34 322248 ----a-w- c:\windows\WLXPGSS.SCR 2014-03-31 07:35 . 2014-04-09 11:13 231584 ------w- c:\windows\system32\MpSigStub.exe 2014-03-17 08:16 . 2014-04-09 11:13 7969936 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9D2385-3BEB-4209-97D8-57574D815AFD}\mpengine.dll 2014-03-11 20:07 . 2014-03-11 20:07 4550656 ----a-w- c:\windows\system32\GPhotos.scr . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{3FB39FFA-CD2E-E78C-BDDC-DC8AAAD8454C}] 2014-06-04 06:43 189440 ----a-w- c:\program files\Buzz-it-soft\171.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}] 2014-05-14 15:35 297128 ----a-w- c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1] @="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}" [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}] 2014-05-14 15:37 223432 ----a-w- c:\users\CF\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2] @="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}" [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}] 2014-05-14 15:37 223432 ----a-w- c:\users\CF\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3] @="{BBACC218-34EA-4666-9D7A-C78F2274A524}" [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}] 2014-05-14 15:37 223432 ----a-w- c:\users\CF\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google+ Auto Backup"="c:\users\CF\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe" [2014-03-26 3701064] "Sony PC Companion"="c:\program files\Sony\Sony PC Companion\PCCompanion.exe" [2014-04-01 466144] "PriceMeterW"="c:\users\CF\AppData\Local\PriceMeter\pricemeterw.exe" [2014-03-13 309768] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1210640] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-05-22 737872] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2014-01-29 145880] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2014-01-29 181208] "Persistence"="c:\windows\system32\igfxpers.exe" [2014-01-29 189912] "Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-05-05 182352] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AviraSpeedup"="c:\program files\Avira\AviraSpeedup\avira_system_speedup.exe" [2014-04-09 5085416] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2014-04-14 280576] . c:\users\CF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ MyPC Backup.lnk - c:\program files\MyPC Backup\MyPC Backup.exe [2014-3-14 2901032] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.141\SSScheduler.exe [2014-1-16 277920] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\SupTab\SearchProtect32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . R2 ca82e1a5;Optimizer Pro Crash Monitor;c:\windows\system32\rundll32.exe [2009-07-14 44544] R2 pricemeterliveUpdate;PriceMeterLiveUpdate Service (pricemeterliveUpdate);c:\program files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-06-04 150504] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe [2014-01-16 235696] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 227600] R3 pricemeterliveUpdatem;PriceMeterLiveUpdate Service (pricemeterliveUpdatem);c:\program files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-06-04 150504] R3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] S1 {0782648b-1717-4fef-ac58-8cb3ce03adb3}w;{0782648b-1717-4fef-ac58-8cb3ce03adb3}w;c:\windows\system32\drivers\{0782648b-1717-4fef-ac58-8cb3ce03adb3}w.sys [2014-05-22 52928] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-02-25 37352] S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-05-22 430160] S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-05-05 124496] S2 BackupStack;Computer Backup (MyPC Backup);c:\program files\MyPC Backup\BackupStack.exe [2014-03-14 36392] S2 Buzz-it;Buzz-it;c:\program files\Buzz-it-soft\Buzz-itOn171.exe [2014-06-04 178688] S2 IePluginServices;IePlugin Services;c:\programdata\IePluginServices\PluginService.exe [2014-05-08 704112] S2 Update ConstaSurf;Update ConstaSurf;c:\program files\ConstaSurf\updateConstaSurf.exe [2014-06-04 317728] S2 Util ConstaSurf;Util ConstaSurf;c:\program files\ConstaSurf\bin\utilConstaSurf.exe [2014-06-04 317728] S2 Wpm;Wpm Service;c:\programdata\WPM\wprotectmanager.exe [2014-05-12 549008] S2 yewimmxqbs32;yewimmxqbs32;c:\program files\002\yewimmxqbs32.exe run options=01100010020000000000000000000000 sourceguid=3A5B3E40-3C96-4F4E-A48D-C161A8B0E1A6 [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-08-24 68208] S3 MEI;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECI.sys [2010-10-19 41088] S3 NETwNs32;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2011-05-01 7513088] . . --- Andere Dienste/Treiber im Speicher --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-05-21 17:32 1091912 ----a-w- c:\program files\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2014-06-04 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-10 20:34] . 2014-06-04 c:\windows\Tasks\Buzz-it Update.job - c:\program files\Buzz-it-soft\Buzz-itf86.exe [2014-06-04 06:43] . 2014-06-04 c:\windows\Tasks\Buzz-it_wd.job - c:\program files\Buzz-it-soft\Buzz-itE.exe [2014-06-04 06:43] . 2014-06-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1544897400-880238543-3682865286-1000Core.job - c:\users\CF\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-19 12:33] . 2014-06-04 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1544897400-880238543-3682865286-1000UA.job - c:\users\CF\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-19 12:33] . 2014-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2014-04-09 11:36] . 2014-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2014-04-09 11:36] . 2014-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544897400-880238543-3682865286-1000Core.job - c:\users\CF\AppData\Local\Google\Update\GoogleUpdate.exe [2014-04-17 21:27] . 2014-06-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544897400-880238543-3682865286-1000UA.job - c:\users\CF\AppData\Local\Google\Update\GoogleUpdate.exe [2014-04-17 21:27] . 2014-06-04 c:\windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job - c:\program files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-06-04 06:44] . 2014-06-04 c:\windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job - c:\program files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-06-04 06:44] . 2014-06-04 c:\windows\Tasks\RegClean Pro_DEFAULT.job - c:\program files\RegClean Pro\RegCleanPro.exe [2014-06-04 16:36] . 2014-06-04 c:\windows\Tasks\RegClean Pro_UPDATES.job - c:\program files\RegClean Pro\RegCleanPro.exe [2014-06-04 16:36] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.sweet-page.com/?type=hp&ts=1401865847&from=cor&uid=ST9500325AS_S2W2SAEEXXXXS2W2SAEE uDefault_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1401865847&from=cor&uid=ST9500325AS_S2W2SAEEXXXXS2W2SAEE&q={searchTerms} mStart Page = hxxp://www.sweet-page.com/?type=hp&ts=1401865847&from=cor&uid=ST9500325AS_S2W2SAEEXXXXS2W2SAEE uInternet Settings,ProxyServer = http=127.0.0.1:13972;https=127.0.0.1:13972 uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Free YouTube to MP3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll TCP: DhcpNameServer = 192.168.178.1 FF - ProfilePath - c:\users\CF\AppData\Roaming\Mozilla\Firefox\Profiles\jroqzdz2.default\ FF - prefs.js: browser.search.selectedEngine - sweet-page FF - prefs.js: browser.startup.homepage - hxxp://www.sweet-page.com/?type=hp&ts=1401865847&from=cor&uid=ST9500325AS_S2W2SAEEXXXXS2W2SAEE . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_USERS\S-1-5-21-1544897400-880238543-3682865286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1544897400-880238543-3682865286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- . - - - - - - - > 'Explorer.exe'(5924) c:\windows\System32\pnidui.dll c:\windows\System32\SyncCenter.dll . ------------------------ Weitere laufende Prozesse ------------------------ . c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Intel\WiFi\bin\EvtEng.exe c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\002\yewimmxqbs32.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\program files\Avira\AntiVir Desktop\avshadow.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\taskhost.exe c:\windows\System32\WUDFHost.exe c:\program files\Advanced System Protector\AdvancedSystemProtector.exe c:\windows\system32\conhost.exe c:\program files\Sony\Sony PC Companion\PCCompanionInfo.exe c:\users\CF\AppData\Local\PriceMeter\pricemeter.exe c:\program files\ConstaSurf\bin\ConstaSurf.PurBrowse.exe c:\windows\system32\conhost.exe c:\program files\ConstaSurf\bin\ConstaSurf.BrowserAdapter.exe c:\windows\system32\wbem\unsecapp.exe c:\users\CF\AppData\Local\PriceMeter\pricemeter.exe c:\users\CF\AppData\Local\PriceMeter\pricemeter.exe c:\users\CF\AppData\Local\PriceMeter\pricemeter.exe c:\windows\system32\sppsvc.exe . ************************************************************************** . Zeit der Fertigstellung: 2014-06-04 12:44:50 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2014-06-04 10:44 . Vor Suchlauf: 16 Verzeichnis(se), 247.411.453.952 Bytes frei Nach Suchlauf: 21 Verzeichnis(se), 248.004.907.008 Bytes frei . - - End Of File - - 206994C9A00F64FBE1D9FC073D345058 A36C5E4F47E84449FF07ED3517B43A31 |
04.06.2014, 12:57 | #2 | |||
/// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Crypted.Gen Hi und
__________________Zitat:
Zitat:
Zitat:
WARNUNG an die MITLESER: Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
__________________ |
04.06.2014, 13:05 | #3 |
| Avira meldet Crypted.Gen dann hab ich es falsch gelesen
__________________Wie kann ich denn eine Neu Installation machen das auch wirklich alles weg ist kann mir das jemand erklären? |
04.06.2014, 13:06 | #4 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Crypted.Gen Lesen und umsetzen von Neuinstallation von Windows
__________________ Logfiles bitte immer in CODE-Tags posten |
05.06.2014, 13:49 | #5 |
| Avira meldet Crypted.Gen Danke, alles neu eingerichtet |
Themen zu Avira meldet Crypted.Gen |
antivir, avira, browser, combofix, desktop, festplatte, firefox, flash player, google, helper, home, internet, internet explorer, monitor, mozilla, mp3, prozesse, rundll, scan, security, server, software, system, updates, windows |