|
Log-Analyse und Auswertung: Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.08.2014, 05:48 | #16 |
/// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\Compiuta\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js C:\Users\Compiuta\AppData\Roaming\0a3 C:\ProgramData\Package Cache
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Frisches FRST log aus dem normalen Modus bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
10.08.2014, 09:55 | #17 |
| Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber,
__________________hier nun das Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:9-08-2014 Ran by SYSTEM at 2014-08-10 10:49:22 Run:3 Running from E:\ Boot Mode: Recovery ============================================== Content of fixlist: ***************** HKU\Compiuta\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js C:\Users\Compiuta\AppData\Roaming\0a3 C:\ProgramData\Package Cache ***************** HKU\Compiuta\Software\Microsoft\Windows\CurrentVersion\Run\\1c2b1 => value deleted successfully. C:\Users\Compiuta\AppData\Roaming\0a3 => Moved successfully. C:\ProgramData\Package Cache => Moved successfully. ==== End of Fixlog ==== FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014 Ran by Compiuta (administrator) on COMPIUTA-PC on 10-08-2014 10:52:09 Running from C:\Users\Compiuta\Desktop Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe (Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe () C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe (Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe (Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Samsung) C:\Program Files\Samsung\Kies\Kies.exe (ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe (VoipStunt) C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.) HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.) HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung) HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY) HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: Internet Explorer proxy is enabled. HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google) FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG) R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] () ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG) S3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation) S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH) S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-10 10:52 - 2014-08-10 10:52 - 00008918 _____ () C:\Users\Compiuta\Desktop\FRST.txt 2014-08-09 12:59 - 2014-08-09 13:00 - 00000000 ____D () C:\Users\Compiuta\Desktop\Antivir 2014-08-08 11:06 - 2014-08-08 11:06 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Compiuta\Downloads\tdsskiller.exe 2014-08-07 09:56 - 2014-08-07 09:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe 2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe 2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT 2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner 2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe 2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe 2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt 2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox 2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt 2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security 2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security 2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe 2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe 2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe 2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt 2014-08-03 15:55 - 2014-08-10 10:52 - 00000000 ____D () C:\FRST 2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt 2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe 2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log 2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable 2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe 2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security 2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys 2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe 2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe 2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe 2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe 2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64 2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner 2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4 2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv 2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2) 2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip 2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip 2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client) 2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2 2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe 2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog 2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-10 10:52 - 2014-08-10 10:52 - 00008918 _____ () C:\Users\Compiuta\Desktop\FRST.txt 2014-08-10 10:52 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST 2014-08-10 10:51 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype 2014-08-10 10:51 - 2009-07-14 06:39 - 00042530 _____ () C:\Windows\setupact.log 2014-08-10 10:50 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync 2014-08-10 10:50 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-10 10:46 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job 2014-08-10 10:46 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job 2014-08-10 10:46 - 2014-01-04 20:06 - 01372182 _____ () C:\Windows\WindowsUpdate.log 2014-08-10 10:45 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-09 13:00 - 2014-08-09 12:59 - 00000000 ____D () C:\Users\Compiuta\Desktop\Antivir 2014-08-09 12:56 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-09 12:56 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-09 12:53 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-09 12:49 - 2010-11-20 23:48 - 00112316 _____ () C:\Windows\PFRO.log 2014-08-08 11:06 - 2014-08-08 11:06 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Compiuta\Downloads\tdsskiller.exe 2014-08-07 12:06 - 2014-04-21 17:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-08-07 12:06 - 2014-04-21 17:20 - 00000000 ____D () C:\Program Files\Avira 2014-08-07 09:56 - 2014-08-07 09:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-07 09:56 - 2014-04-21 17:20 - 00000000 ____D () C:\ProgramData\Avira 2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe 2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe 2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT 2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner 2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe 2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe 2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt 2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox 2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt 2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini 2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security 2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security 2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe 2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe 2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe 2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt 2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt 2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe 2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log 2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable 2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta 2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe 2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security 2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe 2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc 2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog 2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe 2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe 2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe 2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync 2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64 2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner 2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4 2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv 2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2) 2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView 2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET 2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles 2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip 2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip 2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client) 2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2 2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe 2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe 2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle 2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java 2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla 2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe 2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client 2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client 2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity 2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1 2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets 2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe Some content of TEMP: ==================== C:\Users\1\AppData\Local\temp\avgnt.exe C:\Users\Compiuta\AppData\Local\temp\avgnt.exe C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-15 01:40 ==================== End Of Log ============================ Danke! LG Fred |
10.08.2014, 13:12 | #18 |
/// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Gefällt mir schon besser
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyEnable: Internet Explorer proxy is enabled. Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Noch Probleme?
__________________ |
10.08.2014, 15:12 | #19 |
| Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber, hier das neue Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:10-08-2014 Ran by Compiuta at 2014-08-10 15:51:36 Run:4 Running from C:\Users\Compiuta\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** ProxyEnable: Internet Explorer proxy is enabled. ***************** HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully. ==== End of Fixlog ==== Jetzt hätte ich dennoch zwei Fragen: 1) Was mache ich mit USB sticks und Datenträgern die ich in den letzten Monaten verwendet habe? Da ich nicht weiss, seit wann der Virus auf meinem Computer war, weiss ich auch nicht, welche Datenträger alle betroffen sind. Wenn ich diese nun anstecke und formatiere, gefährde ich damit meinen Computer erneut? Kann es zudem sein, dass mein Android Handy beim Datensichern auch infiziert wurde? 2) Und die andere Frage wäre, welche Gefahr von dem Virus ausging, damit ich weiss, ob ich Maßnahmen bezüglich Onlinebanking usw. ergreifen soll. (Insofern aus den Log so etwas herauslesbar ist) Vielen vielen Dank! LG Fred |
10.08.2014, 18:56 | #20 |
/// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Passwörter ändern ist Pflicht. Sticks anstecken, dabei die Shift Taste gedrückt halten, dann passiert nix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
11.08.2014, 09:13 | #21 |
| Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber, heißt das mein Computer ist wieder Virenfrei und kann uneingeschränkt verwendet werden? Würdest du trotzdem ein Neuaufsetzen empfehlen, oder ist dies nicht notwendig? Vielen vielen Dank! LG Fred P.S.: Sobald ich weiss, dass ich mich wieder auf Bank bzw. Paypal mit dem Rechner trauen kann werde ich für die tolle Hilfe eine kleine Spende schicken... |
11.08.2014, 20:31 | #22 |
/// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden wenn ich Neuaufsetzen empfehlen würde hätten wir uns die Arbeit sparen können Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
13.08.2014, 09:37 | #23 |
| Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden VIELEN VIELEN DANK, SCHRAUBER!!! P.S.: Da ich eure Arbeitsuper finde habe auch ich eine kleine Spende geschickt. |
13.08.2014, 19:45 | #24 |
/// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden |
adware, avira, browser, desktop, dnsapi.dll, firefox 31.0, flash player, ftp, google, hdd0(c:, hdd0(c:), hängt, installation, mozilla, netzwerk, problem, programm, prozesse, registry, rojaner gefunden, rundll, scan, security, sich automatisch, software, starten, svchost.exe, trojaner/virus, trojanerfund avira, usb stick nur verknüpfungen, virus, warnung, windows, wuauclt.exe |