| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam gewordenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.07.2014, 10:09
| #16 |
| /// the machine /// TB-Ausbilder    |  Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Wenn die Funde nochmal kommen NICHT LÖSCHEN, melde dich dann hier wieder mit einem FRST Logfile. Ich will mal was kontrollieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.07.2014, 20:20
| #17 |
 | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Hallo Schrauber,
__________________ich hab das jetzt nochmal ausprobiert. Gestern hab ich MWB laufen lassen, da hat es wieder den Broken.OpenCommand gefunden. Dann die zwei Funde in Quatantäne gestellt und Auswahl anwenden geklickt. Neustart. Erneut MWB laufen lassen, es wurde dann kein Fund mehr festgestellt. Ein paar Minuten ebay surfen, Rechner aus. Heute Rechner an und MWB wieder laufen lassen. Erneut genau das gleiche gefunden. Jetzt wie gewünscht MWB ohne Quarantäne abgebrochen und FRST laufen lassen. Hier das Log dazu: Gruß Funcopter FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:29-06-2014
Ran by Roland (administrator) on ROLAND-469D9F2C on 02-07-2014 20:17:46
Running from C:\Dokumente und Einstellungen\Roland\Desktop
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
() C:\Programme\AAVUpdateManager\aavus.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe
(iolo technologies, LLC) C:\Programme\iolo\Common\Lib\ioloServiceManager.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(iolo technologies, LLC) C:\Programme\iolo\System Mechanic\SystemGuardAlerter.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] => C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-23] (APN)
HKLM\...\Runonce: [SMRequiresRestart] - [X]
HKU\S-1-5-21-1004336348-1614895754-725345543-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [MSMSGS] => C:\Programme\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-1004336348-1614895754-725345543-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [swg] => "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-1004336348-1614895754-725345543-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: G - G:\setup.EXE /AUTORUN
HKU\S-1-5-21-1004336348-1614895754-725345543-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: H - H:\setup.exe
BootExecute: autocheck autochk /p \??\J:autocheck autochk /p \??\K:autocheck autochk *
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portal.spk-kg.de/portal/portal/Starten
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://express.foto.com/ImageUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @canon.com/MycameraPlugin - C:\Programme\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-14]
========================== Services (Whitelisted) =================
R2 AAV UpdateService; C:\Programme\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-23] (APN LLC.)
S4 CCALib8; C:\Programme\Canon\CAL\CALMAIN.exe [96370 2007-01-31] (Canon Inc.) [File not signed]
R2 ioloSystemService; C:\Programme\iolo\Common\Lib\ioloServiceManager.exe [1027792 2012-09-05] (iolo technologies, LLC)
S4 JavaQuickStarterService; C:\Programme\Java\jre7\bin\jqs.exe [182696 2014-05-01] (Oracle Corporation)
S4 MagicTuneEngine; C:\Programme\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] () [File not signed]
S4 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2003-06-19] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S4 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3964352 2006-04-21] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [97648 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 DC21x4; C:\WINDOWS\System32\DRIVERS\dc21x4.sys [63208 2001-08-17] (Intel Corporation.)
R3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2008-04-13] (Microsoft Corporation)
S3 giveio; C:\WINDOWS\system32\giveio.sys [5248 2010-08-18] () [File not signed]
S3 hidgame; C:\WINDOWS\System32\DRIVERS\hidgame.sys [8576 2001-08-17] (Microsoft Corporation)
S3 MagicTune; C:\WINDOWS\System32\drivers\MTiCtwl.sys [14080 2009-06-04] (Samsung Electronics, Inc. ) [File not signed]
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [110296 2014-07-02] (Malwarebytes Corporation)
R2 PDFsFilter; C:\WINDOWS\System32\DRIVERS\PDFsFilter.sys [68464 2012-09-05] (Raxco Software, Inc.)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\Roland\LOKALE~1\Temp\catchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
U3 TlntSvr;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-02 20:17 - 2014-07-02 20:18 - 00010599 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-02 15:25 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-05-12 07:26 - 00053208 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-07-01 15:48 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:46 - 2014-07-01 15:46 - 01073664 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-06-24 20:07 - 2014-06-24 20:07 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-06-22 21:26 - 2014-06-22 21:37 - 00000000 ____D () C:\AdwCleaner
2014-06-21 13:53 - 2014-06-21 17:13 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-21 10:01 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-06-21 10:01 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-06-21 10:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-06-19 21:03 - 2014-07-02 20:17 - 00000000 ____D () C:\FRST
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
2014-06-05 19:40 - 2014-06-05 20:17 - 00035328 _____ () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\BG Unfall Valentin.xls
==================== One Month Modified Files and Folders =======
2014-07-02 20:18 - 2014-07-02 20:17 - 00010599 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-02 20:18 - 2013-10-11 21:54 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp
2014-07-02 20:18 - 2010-01-15 19:58 - 00000418 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{7ECA2FDA-3924-46EF-86A0-4D266F44C228}.job
2014-07-02 20:17 - 2014-06-19 21:03 - 00000000 ____D () C:\FRST
2014-07-02 19:32 - 2014-03-22 09:26 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-07-02 18:03 - 2008-04-26 11:09 - 00032544 _____ () C:\WINDOWS\SchedLgU.Txt
2014-07-02 16:00 - 2008-04-26 11:04 - 01952399 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-02 15:25 - 2014-07-01 15:48 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-02 15:14 - 2014-03-30 18:37 - 00000224 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Benachrichtigung – Anmeldung.job
2014-07-02 15:13 - 2008-04-26 11:58 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-07-02 15:13 - 2008-04-26 11:58 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-07-02 15:13 - 2008-04-26 11:09 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-01 21:53 - 2008-04-26 11:11 - 00000300 ___SH () C:\Dokumente und Einstellungen\Roland\ntuser.ini
2014-07-01 21:53 - 2008-04-26 11:11 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2008-04-26 11:55 - 00000000 ___RD () C:\Programme
2014-07-01 15:48 - 2008-04-26 11:55 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:46 - 2014-07-01 15:46 - 01073664 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-07-01 15:36 - 2013-08-22 17:15 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-06-29 15:30 - 2013-08-22 17:19 - 00000000 ____D () C:\Programme\AskPartnerNetwork
2014-06-29 15:28 - 2004-08-04 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-06-25 15:40 - 2013-08-14 08:38 - 00184641 _____ () C:\WINDOWS\setupapi.log
2014-06-24 20:07 - 2014-06-24 20:07 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-06-22 21:37 - 2014-06-22 21:26 - 00000000 ____D () C:\AdwCleaner
2014-06-21 17:13 - 2014-06-21 13:53 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
2014-06-13 21:41 - 2014-05-02 19:50 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\SigmaDataCenter3
2014-06-13 14:38 - 2013-10-12 14:12 - 00001780 _____ () C:\DelFix.txt
2014-06-12 11:50 - 2011-01-02 15:02 - 00000000 ____D () C:\WINDOWS\system32\NtmsData
2014-06-12 09:58 - 2008-04-26 11:02 - 00000000 ____D () C:\WINDOWS\Registration
2014-06-11 12:49 - 2013-07-19 16:01 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-11 12:42 - 2008-04-26 13:10 - 92708840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-06-09 17:43 - 2014-03-30 18:37 - 00000218 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job
2014-06-05 20:17 - 2014-06-05 19:40 - 00035328 _____ () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\BG Unfall Valentin.xls
2014-06-05 09:53 - 2008-04-28 20:17 - 00000190 ___SH () C:\Dokumente und Einstellungen\Vonni\ntuser.ini
2014-06-05 09:53 - 2008-04-28 20:17 - 00000000 ____D () C:\Dokumente und Einstellungen\Vonni
2014-06-05 08:41 - 2013-08-22 17:15 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2014-06-05 08:28 - 2008-04-28 20:17 - 00000000 ____D () C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\Temp
Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\AskSLib.dll
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\wiz99.exe
==================== Bamital & volsnap Check =================
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
|
|
03.07.2014, 12:09
| #18 |
| /// the machine /// TB-Ausbilder | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.
__________________Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM\...\Run: [nwiz] => nwiz.exe /install
HKLM\...\Run: [ApnTBMon] => C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-23] (APN)
HKLM\...\Runonce: [SMRequiresRestart] - [X]
BootExecute: autocheck autochk /p \??\J:autocheck autochk /p \??\K:autocheck autochk *
R2 AAV UpdateService; C:\Programme\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
C:\Programme\AAVUpdateManager
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Nochmal testen.
__________________ |
|
03.07.2014, 15:19
| #19 |
| | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Hallo Schrauber, erledigt. Gruß Funcopter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:29-06-2014 Ran by Roland at 2014-07-03 16:18:30 Run:1 Running from C:\Dokumente und Einstellungen\Roland\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** HKLM\...\Run: [nwiz] => nwiz.exe /install HKLM\...\Run: [ApnTBMon] => C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-23] (APN) HKLM\...\Runonce: [SMRequiresRestart] - [X] BootExecute: autocheck autochk /p \??\J:autocheck autochk /p \??\K:autocheck autochk * R2 AAV UpdateService; C:\Programme\AAVUpdateManager\aavus.exe [128296 2008-10-24] () C:\Programme\AAVUpdateManager ***************** HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ApnTBMon => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SMRequiresRestart => Value not found. HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully. AAV UpdateService => Service stopped successfully. AAV UpdateService => Service deleted successfully. C:\Programme\AAVUpdateManager => Moved successfully. ==== End of Fixlog ==== |
|
04.07.2014, 13:06
| #20 |
| /// the machine /// TB-Ausbilder | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.07.2014, 11:40
| #21 |
| | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Hallo Schrauber, Problem unverändert noch da. Ich habe heute einen MWB Suchlauf gemacht mit dem Ergebniss wie immer. Gruß Funcopter |
|
06.07.2014, 17:44
| #22 |
| /// the machine /// TB-Ausbilder | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Ich glaub da ja eher an einen Fehlalarm von MBAM. Poste mal bitte en frisches FRST log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.07.2014, 19:03
| #23 |
| | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Hallo Schrauber, hier das Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-07-2014 01
Ran by Roland (administrator) on ROLAND-469D9F2C on 06-07-2014 19:55:12
Running from C:\Dokumente und Einstellungen\Roland\Desktop
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe
(iolo technologies, LLC) C:\Programme\iolo\Common\Lib\ioloServiceManager.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
(iolo technologies, LLC) C:\Programme\iolo\System Mechanic\SystemGuardAlerter.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-01] (Avira Operations GmbH & Co. KG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portal.spk-kg.de/portal/portal/Starten
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://express.foto.com/ImageUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @canon.com/MycameraPlugin - C:\Programme\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-14]
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-23] (APN LLC.)
S4 CCALib8; C:\Programme\Canon\CAL\CALMAIN.exe [96370 2007-01-31] (Canon Inc.) [File not signed]
R2 ioloSystemService; C:\Programme\iolo\Common\Lib\ioloServiceManager.exe [1027792 2012-09-05] (iolo technologies, LLC)
S4 JavaQuickStarterService; C:\Programme\Java\jre7\bin\jqs.exe [182696 2014-05-01] (Oracle Corporation)
S4 MagicTuneEngine; C:\Programme\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] () [File not signed]
S4 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2003-06-19] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S4 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3964352 2006-04-21] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [97648 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 DC21x4; C:\WINDOWS\System32\DRIVERS\dc21x4.sys [63208 2001-08-17] (Intel Corporation.)
R3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2008-04-13] (Microsoft Corporation)
S3 giveio; C:\WINDOWS\system32\giveio.sys [5248 2010-08-18] () [File not signed]
S3 hidgame; C:\WINDOWS\System32\DRIVERS\hidgame.sys [8576 2001-08-17] (Microsoft Corporation)
S3 MagicTune; C:\WINDOWS\System32\drivers\MTiCtwl.sys [14080 2009-06-04] (Samsung Electronics, Inc. ) [File not signed]
R2 PDFsFilter; C:\WINDOWS\System32\DRIVERS\PDFsFilter.sys [68464 2012-09-05] (Raxco Software, Inc.)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\Roland\LOKALE~1\Temp\catchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
U3 TlntSvr;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-02 21:14 - 2014-07-02 21:14 - 00018742 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt.2.txt
2014-07-02 20:17 - 2014-07-06 19:55 - 00009225 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-06 09:01 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-05-12 07:26 - 00053208 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-07-01 15:48 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:46 - 2014-07-06 19:45 - 01074688 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-06-24 20:07 - 2014-07-06 19:45 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-06-22 21:26 - 2014-06-22 21:37 - 00000000 ____D () C:\AdwCleaner
2014-06-21 13:53 - 2014-06-21 17:13 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-21 10:01 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-06-21 10:01 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-06-21 10:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-06-19 21:03 - 2014-07-06 19:55 - 00000000 ____D () C:\FRST
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
==================== One Month Modified Files and Folders =======
2014-07-06 19:55 - 2014-07-02 20:17 - 00009225 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-06 19:55 - 2014-06-19 21:03 - 00000000 ____D () C:\FRST
2014-07-06 19:55 - 2013-10-11 21:54 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp
2014-07-06 19:53 - 2010-01-15 19:58 - 00000418 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{7ECA2FDA-3924-46EF-86A0-4D266F44C228}.job
2014-07-06 19:45 - 2014-07-01 15:46 - 01074688 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-07-06 19:45 - 2014-06-24 20:07 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-07-06 19:32 - 2014-03-22 09:26 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-07-06 19:31 - 2008-04-26 11:04 - 02001319 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-06 19:30 - 2014-03-30 18:37 - 00000224 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Benachrichtigung – Anmeldung.job
2014-07-06 19:27 - 2008-04-26 11:58 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-07-06 19:27 - 2008-04-26 11:58 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-07-06 19:27 - 2008-04-26 11:09 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-06 12:43 - 2008-04-26 11:11 - 00000300 ___SH () C:\Dokumente und Einstellungen\Roland\ntuser.ini
2014-07-06 12:43 - 2008-04-26 11:09 - 00032218 _____ () C:\WINDOWS\SchedLgU.Txt
2014-07-06 12:42 - 2008-04-26 11:11 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland
2014-07-06 09:01 - 2014-07-01 15:48 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-05 20:23 - 2004-08-04 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-07-03 16:18 - 2008-04-26 11:55 - 00000000 ___RD () C:\Programme
2014-07-02 21:14 - 2014-07-02 21:14 - 00018742 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt.2.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware
2014-07-01 15:48 - 2008-04-26 11:55 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:36 - 2013-08-22 17:15 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-06-29 15:30 - 2013-08-22 17:19 - 00000000 ____D () C:\Programme\AskPartnerNetwork
2014-06-25 15:40 - 2013-08-14 08:38 - 00184641 _____ () C:\WINDOWS\setupapi.log
2014-06-22 21:37 - 2014-06-22 21:26 - 00000000 ____D () C:\AdwCleaner
2014-06-21 17:13 - 2014-06-21 13:53 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
2014-06-13 21:41 - 2014-05-02 19:50 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\SigmaDataCenter3
2014-06-13 14:38 - 2013-10-12 14:12 - 00001780 _____ () C:\DelFix.txt
2014-06-12 11:50 - 2011-01-02 15:02 - 00000000 ____D () C:\WINDOWS\system32\NtmsData
2014-06-12 09:58 - 2008-04-26 11:02 - 00000000 ____D () C:\WINDOWS\Registration
2014-06-11 12:49 - 2013-07-19 16:01 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-11 12:42 - 2008-04-26 13:10 - 92708840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-06-09 17:43 - 2014-03-30 18:37 - 00000218 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job
Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\AskSLib.dll
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\wiz99.exe
==================== Bamital & volsnap Check =================
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
Gruß Funcopter |
|
07.07.2014, 12:48
| #24 |
| /// the machine /// TB-Ausbilder | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Was macht die Geschwindigkeit des Rechners?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.07.2014, 09:10
| #25 |
| | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Hallo Schrauber, ist unverändert langsam. Die rote LED leuchtet nahezu ununterbrochen und er "rattert" permanent. Gruß Funcopter |
|
09.07.2014, 08:09
| #26 |
| /// the machine /// TB-Ausbilder | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Festplatte schon auf Hardwaredefekt geprüft?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.07.2014, 11:25
| #27 |
| | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Hallo Schrauber, verrätst Du mir auch wie ich die überprüfen kann?  Gruß Funcopter |
|
10.07.2014, 11:33
| #28 |
| /// the machine /// TB-Ausbilder | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Versuch mal das Tool von Seatools 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2014, 17:21
| #29 |
| | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Hallo Schrauber, das Seatool hat nicht funktioniert. Ich habe mir das GSmartControl runtergeladen und drüber laufen lassen. Ich hoffe das war jetzt nicht falsch. Die erste Festplatte hat 1760 Fehler im Laufe von 12244 Betriebsstunden gezählt und die zweite 61246 im Laufe von 54096 Stunden. Ob ein aktueller Fehler da drauf ist kann ich aus derm Log nicht sehen. Vielleicht siehst Du da ja was. Hier die zugehörigen Logs: Gruß Funcopter Complete error log: SMART Error Log Version: 1 ATA Error Count: 1760 (device log contains only the most recent five errors) CR = Command Register [HEX] FR = Features Register [HEX] SC = Sector Count Register [HEX] SN = Sector Number Register [HEX] CL = Cylinder Low Register [HEX] CH = Cylinder High Register [HEX] DH = Device/Head Register [HEX] DC = Device Command Register [HEX] ER = Error register [HEX] ST = Status register [HEX] Powered_Up_Time is measured from power on, and printed as DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes, SS=sec, and sss=millisec. It "wraps" after 49.710 days. Error 1760 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95 Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- c8 00 7f 5f 00 00 e0 00 00:01:34.647 READ DMA c8 00 7f 5f 00 00 e0 00 00:01:34.194 READ DMA 10 00 ff 00 00 00 e0 00 00:01:34.194 RECALIBRATE [OBS-4] c8 00 7f 5f 00 00 e0 00 00:01:33.759 READ DMA c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA Error 1759 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95 Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- c8 00 7f 5f 00 00 e0 00 00:01:34.194 READ DMA 10 00 ff 00 00 00 e0 00 00:01:34.194 RECALIBRATE [OBS-4] c8 00 7f 5f 00 00 e0 00 00:01:33.759 READ DMA c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA c8 00 01 3f 00 00 e0 00 00:01:33.263 READ DMA Error 1758 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95 Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- c8 00 7f 5f 00 00 e0 00 00:01:33.759 READ DMA c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA c8 00 01 3f 00 00 e0 00 00:01:33.263 READ DMA c8 00 01 25 0d cb e2 00 00:01:32.545 READ DMA c8 00 01 00 00 00 e0 00 00:01:32.545 READ DMA Error 1757 occurred at disk power-on lifetime: 12244 hours (510 days + 4 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 84 51 00 5f 00 00 e0 Error: ICRC, ABRT at LBA = 0x0000005f = 95 Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- c8 00 7f 5f 00 00 e0 00 00:01:33.264 READ DMA c8 00 01 3f 00 00 e0 00 00:01:33.263 READ DMA c8 00 01 25 0d cb e2 00 00:01:32.545 READ DMA c8 00 01 00 00 00 e0 00 00:01:32.545 READ DMA c8 00 01 00 00 00 e0 00 00:01:32.545 READ DMA Error 1756 occurred at disk power-on lifetime: 7622 hours (317 days + 14 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 84 51 00 c7 00 00 e0 Error: ICRC, ABRT at LBA = 0x000000c7 = 199 Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- c8 00 08 c7 00 00 e0 00 00:00:32.113 READ DMA c8 00 08 bf 00 00 e0 00 00:00:32.113 READ DMA c8 00 08 b7 00 00 e0 00 00:00:32.113 READ DMA c8 00 08 af 00 00 e0 00 00:00:32.112 READ DMA c8 00 08 a7 00 00 e0 00 00:00:32.112 READ DMA Complete error log: SMART Error Log Version: 1 Warning: ATA error count 61246 inconsistent with error log pointer 5 ATA Error Count: 61246 (device log contains only the most recent five errors) CR = Command Register [HEX] FR = Features Register [HEX] SC = Sector Count Register [HEX] SN = Sector Number Register [HEX] CL = Cylinder Low Register [HEX] CH = Cylinder High Register [HEX] DH = Device/Head Register [HEX] DC = Device Command Register [HEX] ER = Error register [HEX] ST = Status register [HEX] Powered_Up_Time is measured from power on, and printed as DDd+hh:mm:SS.sss where DD=days, hh=hours, mm=minutes, SS=sec, and sss=millisec. It "wraps" after 49.710 days. Error 61246 occurred at disk power-on lifetime: 54096 hours (2254 days + 0 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 04 51 01 01 00 00 a0 Error: ABRT Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- a1 00 01 01 00 00 a0 00 35d+17:42:08.640 IDENTIFY PACKET DEVICE c8 00 08 77 a5 34 e1 00 29d+16:53:44.320 READ DMA 08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET 00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands] e0 00 00 00 00 00 a0 00 29d+16:53:44.320 STANDBY IMMEDIATE Error 61245 occurred at disk power-on lifetime: 54096 hours (2254 days + 0 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 04 51 01 01 00 00 a0 Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- 08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET 00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands] e0 00 00 00 00 00 a0 00 29d+16:53:44.320 STANDBY IMMEDIATE c8 00 40 91 a7 2c e1 00 29d+16:53:44.320 READ DMA c8 00 08 77 a5 34 e1 00 29d+16:53:44.320 READ DMA Error 61244 occurred at disk power-on lifetime: 53584 hours (2232 days + 16 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 04 51 01 01 00 00 a0 Error: ABRT Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- a1 00 01 01 00 00 a0 00 35d+17:42:08.640 IDENTIFY PACKET DEVICE c8 00 08 47 31 e3 e0 00 34d+08:01:57.760 READ DMA 08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET 00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands] e0 00 00 00 00 00 a0 00 34d+08:01:57.760 STANDBY IMMEDIATE Error 61243 occurred at disk power-on lifetime: 53584 hours (2232 days + 16 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 04 51 01 01 00 00 a0 Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- 08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET 00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands] e0 00 00 00 00 00 a0 00 34d+08:01:57.760 STANDBY IMMEDIATE c8 00 08 97 36 8f e0 00 34d+08:01:57.760 READ DMA c8 00 08 47 31 e3 e0 00 34d+08:01:57.760 READ DMA Error 61242 occurred at disk power-on lifetime: 53072 hours (2211 days + 8 hours) When the command that caused the error occurred, the device was active or idle. After command completion occurred, registers were: ER ST SC SN CL CH DH -- -- -- -- -- -- -- 04 51 01 01 00 00 a0 Error: ABRT Commands leading to the command that caused the error were: CR FR SC SN CL CH DH DC Powered_Up_Time Command/Feature_Name -- -- -- -- -- -- -- -- ---------------- -------------------- a1 00 01 01 00 00 a0 00 35d+17:42:08.640 IDENTIFY PACKET DEVICE 08 00 01 01 00 00 a0 00 35d+17:42:08.640 DEVICE RESET 00 00 01 01 00 00 00 00 40d+09:28:39.680 NOP [Abort queued commands] e0 00 00 00 00 00 a0 00 48d+03:54:28.480 STANDBY IMMEDIATE c8 00 08 af 40 00 e1 00 48d+03:54:28.480 READ DMA |
|
12.07.2014, 15:46
| #30 |
| /// the machine /// TB-Ausbilder | Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Welcher Hersteller ist die Platte? Vielleicht gibt es ein Hersteller Tool zum Testen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden |
| brauche, broken.opencommand, dauert, eingefangen, gefangen, gelöscht, geschwindigkeit, glaskugel, langsam, malwarebytes, permanent, plagegeist, problem, pup.optional.babylon.a, quarantäne, rechner, schonmal, verschiebt, virus, win32/toolbar.conduit |
Linear-Darstellung
