Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden

schrauber · 06.07.2014, 17:44

Ich glaub da ja eher an einen Fehlalarm von MBAM. Poste mal bitte en frisches FRST log.

funcopter · 06.07.2014, 19:03

Hallo Schrauber,

hier das Log:
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-07-2014 01
Ran by Roland (administrator) on ROLAND-469D9F2C on 06-07-2014 19:55:12
Running from C:\Dokumente und Einstellungen\Roland\Desktop
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe
(iolo technologies, LLC) C:\Programme\iolo\Common\Lib\ioloServiceManager.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
(iolo technologies, LLC) C:\Programme\iolo\System Mechanic\SystemGuardAlerter.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [750160 2014-07-01] (Avira Operations GmbH & Co. KG)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portal.spk-kg.de/portal/portal/Starten
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {E048E9E7-473E-4DA0-9D49-2392C5509B4D} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://express.foto.com/ImageUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin: @canon.com/MycameraPlugin - C:\Programme\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-14]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-07-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-23] (APN LLC.)
S4 CCALib8; C:\Programme\Canon\CAL\CALMAIN.exe [96370 2007-01-31] (Canon Inc.) [File not signed]
R2 ioloSystemService; C:\Programme\iolo\Common\Lib\ioloServiceManager.exe [1027792 2012-09-05] (iolo technologies, LLC)
S4 JavaQuickStarterService; C:\Programme\Java\jre7\bin\jqs.exe [182696 2014-05-01] (Oracle Corporation)
S4 MagicTuneEngine; C:\Programme\MagicTune Premium\MagicTuneEngine.exe [45056 2007-08-23] () [File not signed]
S4 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2003-06-19] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S4 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [3964352 2006-04-21] (Realtek Semiconductor Corp.)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [97648 2014-07-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-06-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 DC21x4; C:\WINDOWS\System32\DRIVERS\dc21x4.sys [63208 2001-08-17] (Intel Corporation.)
R3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2008-04-13] (Microsoft Corporation)
S3 giveio; C:\WINDOWS\system32\giveio.sys [5248 2010-08-18] () [File not signed]
S3 hidgame; C:\WINDOWS\System32\DRIVERS\hidgame.sys [8576 2001-08-17] (Microsoft Corporation)
S3 MagicTune; C:\WINDOWS\System32\drivers\MTiCtwl.sys [14080 2009-06-04] (Samsung Electronics, Inc. ) [File not signed]
R2 PDFsFilter; C:\WINDOWS\System32\DRIVERS\PDFsFilter.sys [68464 2012-09-05] (Raxco Software, Inc.)
R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [28672 2006-11-06] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\Roland\LOKALE~1\Temp\catchme.sys [X]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
U3 TlntSvr; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-02 21:14 - 2014-07-02 21:14 - 00018742 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt.2.txt
2014-07-02 20:17 - 2014-07-06 19:55 - 00009225 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-06 09:01 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware 
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware 
2014-07-01 15:48 - 2014-05-12 07:26 - 00053208 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-07-01 15:48 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:46 - 2014-07-06 19:45 - 01074688 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-06-24 20:07 - 2014-07-06 19:45 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-06-22 21:26 - 2014-06-22 21:37 - 00000000 ____D () C:\AdwCleaner
2014-06-21 13:53 - 2014-06-21 17:13 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-21 10:01 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-06-21 10:01 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-06-21 10:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-06-21 10:01 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-06-19 21:03 - 2014-07-06 19:55 - 00000000 ____D () C:\FRST
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET

==================== One Month Modified Files and Folders =======

2014-07-06 19:55 - 2014-07-02 20:17 - 00009225 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt
2014-07-06 19:55 - 2014-06-19 21:03 - 00000000 ____D () C:\FRST
2014-07-06 19:55 - 2013-10-11 21:54 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp
2014-07-06 19:53 - 2010-01-15 19:58 - 00000418 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{7ECA2FDA-3924-46EF-86A0-4D266F44C228}.job
2014-07-06 19:45 - 2014-07-01 15:46 - 01074688 _____ (Farbar) C:\Dokumente und Einstellungen\Roland\Desktop\FRST.exe
2014-07-06 19:45 - 2014-06-24 20:07 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Desktop\FRST-OlderVersion
2014-07-06 19:32 - 2014-03-22 09:26 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-07-06 19:31 - 2008-04-26 11:04 - 02001319 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-06 19:30 - 2014-03-30 18:37 - 00000224 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP –  Benachrichtigung – Anmeldung.job
2014-07-06 19:27 - 2008-04-26 11:58 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-07-06 19:27 - 2008-04-26 11:58 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-07-06 19:27 - 2008-04-26 11:09 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-06 12:43 - 2008-04-26 11:11 - 00000300 ___SH () C:\Dokumente und Einstellungen\Roland\ntuser.ini
2014-07-06 12:43 - 2008-04-26 11:09 - 00032218 _____ () C:\WINDOWS\SchedLgU.Txt
2014-07-06 12:42 - 2008-04-26 11:11 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland
2014-07-06 09:01 - 2014-07-01 15:48 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-07-05 20:23 - 2004-08-04 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2014-07-03 16:18 - 2008-04-26 11:55 - 00000000 ___RD () C:\Programme
2014-07-02 21:14 - 2014-07-02 21:14 - 00018742 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\FRST.txt.2.txt
2014-07-01 18:05 - 2014-07-01 18:05 - 00001456 _____ () C:\Dokumente und Einstellungen\Roland\Desktop\mwb.txt
2014-07-01 15:48 - 2014-07-01 15:48 - 00000749 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Programme\ Malwarebytes Anti-Malware 
2014-07-01 15:48 - 2014-07-01 15:48 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ Malwarebytes Anti-Malware 
2014-07-01 15:48 - 2008-04-26 11:55 - 00000000 ___RD () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-07-01 15:47 - 2014-07-01 15:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Roland\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-01 15:36 - 2013-08-22 17:15 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-06-29 15:30 - 2013-08-22 17:19 - 00000000 ____D () C:\Programme\AskPartnerNetwork
2014-06-25 15:40 - 2013-08-14 08:38 - 00184641 _____ () C:\WINDOWS\setupapi.log
2014-06-22 21:37 - 2014-06-22 21:26 - 00000000 ____D () C:\AdwCleaner
2014-06-21 17:13 - 2014-06-21 13:53 - 00000000 ___SD () C:\ComboFix
2014-06-21 10:01 - 2014-06-21 10:01 - 00000000 ____D () C:\Qoobox
2014-06-17 20:39 - 2014-06-17 20:39 - 00000000 ____D () C:\Programme\ESET
2014-06-13 21:41 - 2014-05-02 19:50 - 00000000 ____D () C:\Dokumente und Einstellungen\Roland\Eigene Dateien\SigmaDataCenter3
2014-06-13 14:38 - 2013-10-12 14:12 - 00001780 _____ () C:\DelFix.txt
2014-06-12 11:50 - 2011-01-02 15:02 - 00000000 ____D () C:\WINDOWS\system32\NtmsData
2014-06-12 09:58 - 2008-04-26 11:02 - 00000000 ____D () C:\WINDOWS\Registration
2014-06-11 12:49 - 2013-07-19 16:01 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-06-11 12:42 - 2008-04-26 13:10 - 92708840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-06-09 17:43 - 2014-03-30 18:37 - 00000218 _____ () C:\WINDOWS\Tasks\Ende des Supports für Microsoft Windows XP – Monatliche Benachrichtigung.job

Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Roland\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\AskSLib.dll
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\avgnt.exe
C:\Dokumente und Einstellungen\Vonni\Lokale Einstellungen\temp\wiz99.exe


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

--- --- ---

Gruß
Funcopter

06.07.2014, 17:44	#1
schrauber /// the machine /// TB-Ausbilder	Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden Ich glaub da ja eher an einen Fehlalarm von MBAM. Poste mal bitte en frisches FRST log. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden

Plagegeister aller Art und deren Bekämpfung: Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden

Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden

Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden

Ähnliche Themen: Broken.OpenCommand Virus gefunden-Rechner ist extrem langsam geworden