Microsoft Meldung Zeus Virus

Isei · 22.05.2017, 11:47

Code:

ATTFilter


	Code: 

 ATTFilter

  
	HitmanPro 3.7.20.286
www.hitmanpro.com

   Computer name . . . . : DESKTOP-EJFS8EO
   Windows . . . . . . . : 10.0.0.14393.X64/4
   User name . . . . . . : DESKTOP-EJFS8EO\K21
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-05-22 11:49:25
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1m 11s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 5

   Objects scanned . . . : 1.764.462
   Files scanned . . . . : 40.558
   Remnants scanned  . . : 442.753 files / 1.281.151 keys

Suspicious files ____________________________________________________________

   C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\537NBXO2\FRST64[1].exe
      Size . . . . . . . : 2.429.952 bytes
      Age  . . . . . . . : 2.0 days (2017-05-20 12:47:53)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 2779C6201CF32B8DEA1EF2CA48CF00DAB916B1464246CC78AA9A0D77B27FF561
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -5.2s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{3CD9D500-A730-4A35-88CC-7B3BD77EA696}
         -2.5s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\US5C11J5\82[1].htm
         -1.1s C:\Users\K21\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -1.1s C:\Users\K21\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -0.4s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCookies\UCACJTP7.cookie
         -0.4s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\61X03ER3\82[1].htm
         -0.0s C:\Windows\Temp\DESKTOP-EJFS8EO-20170520-1247.log
          0.0s C:\Users\K21\Desktop\FRST64.exe
          0.0s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\537NBXO2\FRST64[1].exe
          3.8s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\DEF70E598054CBA08FFB78A8CBD9F0CF
          4.0s C:\Users\K21\Desktop\FRST-OlderVersion\
          6.6s C:\Windows\Prefetch\FRST64.EXE-7A273C87.pf
          7.3s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\Z6IAON8I\up64[1]
         11.3s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{F07E7F81-322B-4304-942B-643A1DFC0B8F}
         15.0s C:\Windows\Prefetch\SCHTASKS.EXE-8B6144A9.pf

   C:\Users\K21\Desktop\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.429.952 bytes
      Age  . . . . . . . : 3.7 days (2017-05-18 20:07:37)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : B29D55BCE7D53911FB96A3EA6CF46F656731DC932CBAF3A6E08FA9DDF4F1802C
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -16.3s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\44\48E01583A0237F68.dat
         -9.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\18\BE663D41F5CAE996.dat
          0.0s C:\Users\K21\Desktop\FRST-OlderVersion\FRST64.exe
          1.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\22\D23BCDE104EF74D6.dat
          1.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\60\EA74D580AA0E8B9C.dat
          3.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\59\1A8D5B711D04668F.dat
         12.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\51\500859B45C35590F.dat

   C:\Users\K21\Desktop\FRST64.exe
      Size . . . . . . . : 2.429.952 bytes
      Age  . . . . . . . : 2.0 days (2017-05-20 12:47:53)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 2779C6201CF32B8DEA1EF2CA48CF00DAB916B1464246CC78AA9A0D77B27FF561
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -5.2s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{3CD9D500-A730-4A35-88CC-7B3BD77EA696}
         -2.5s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\US5C11J5\82[1].htm
         -1.1s C:\Users\K21\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -1.1s C:\Users\K21\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -0.4s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCookies\UCACJTP7.cookie
         -0.4s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\61X03ER3\82[1].htm
         -0.0s C:\Windows\Temp\DESKTOP-EJFS8EO-20170520-1247.log
          0.0s C:\Users\K21\Desktop\FRST64.exe
          0.0s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\537NBXO2\FRST64[1].exe
          3.8s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\DEF70E598054CBA08FFB78A8CBD9F0CF
          4.0s C:\Users\K21\Desktop\FRST-OlderVersion\
          6.6s C:\Windows\Prefetch\FRST64.EXE-7A273C87.pf
          7.3s C:\Users\K21\AppData\Local\Microsoft\Windows\INetCache\IE\Z6IAON8I\up64[1]
         11.3s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{F07E7F81-322B-4304-942B-643A1DFC0B8F}
         15.0s C:\Windows\Prefetch\SCHTASKS.EXE-8B6144A9.pf

   C:\windows\system32\drivers\mbae64.sys
      Size . . . . . . . : 77.440 bytes
      Age  . . . . . . . : 2.0 days (2017-05-20 12:39:15)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : E5EF1F30891050729B248013B4D7881FC556D259E2BE3F51980C3A247D3F5950
      RSA Key Size . . . : 2048
      Service  . . . . . : ESProtectionDriver
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 26.0
         The file is completely hidden from view and most antivirus products. It may belong to a rootkit.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program starts automatically without user intervention.
         Time indicates that the file appeared recently on this computer.
         The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
         Starts automatically as a service during system bootup.
         The file is a device driver. Device drivers run as trusted (highly privileged) code.
         Program is code signed with a valid Authenticode certificate.
      Startup
         HKLM\SYSTEM\ControlSet001\Services\ESProtectionDriver\
      Forensic Cluster
         -4.6s C:\ProgramData\Malwarebytes\MBAMService\logs\
         -4.6s C:\Program Files\Malwarebytes\Anti-Malware\
         -4.6s C:\Program Files\Malwarebytes\Anti-Malware\unins000.dat
         -4.6s C:\ProgramData\Malwarebytes\MBAMService\config\
         -4.6s C:\ProgramData\Malwarebytes\MBAMService\
         -4.6s C:\Program Files\Malwarebytes\
         -4.6s C:\ProgramData\Malwarebytes\
         -4.6s C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe
         -4.6s C:\Program Files\Malwarebytes\Anti-Malware\suhlpr.dll
         -4.5s C:\Program Files\Malwarebytes\Anti-Malware\changes.txt
         -4.5s C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
         -4.3s C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
         -4.2s C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
         -4.2s C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
         -4.2s C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
         -4.0s C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll
         -3.9s C:\Program Files\Malwarebytes\Anti-Malware\Qt5Gui.dll
         -3.7s C:\Program Files\Malwarebytes\Anti-Malware\Qt5Network.dll
         -3.7s C:\Program Files\Malwarebytes\Anti-Malware\Qt5Qml.dll
         -3.6s C:\Program Files\Malwarebytes\Anti-Malware\Qt5Quick.dll
         -3.5s C:\Program Files\Malwarebytes\Anti-Malware\Qt5Svg.dll
         -3.4s C:\Program Files\Malwarebytes\Anti-Malware\Qt5Widgets.dll
         -3.3s C:\Program Files\Malwarebytes\Anti-Malware\Qt5WinExtras.dll
         -3.3s C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\
         -3.3s C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\JumpListDestination.qml
         -3.2s C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\JumpListLink.qml
         -3.2s C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\JumpListSeparator.qml
         -3.2s C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\plugins.qmltypes
         -3.2s C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\qmldir
         -3.2s C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\qml_winextras.dll
         -3.2s C:\Program Files\Malwarebytes\Anti-Malware\msvcp120.dll
         -3.2s C:\Program Files\Malwarebytes\Anti-Malware\msvcr120.dll
         -3.1s C:\Program Files\Malwarebytes\Anti-Malware\iconengines\
         -3.1s C:\Program Files\Malwarebytes\Anti-Malware\iconengines\qsvgicon.dll
         -3.1s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\
         -3.1s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qdds.dll
         -3.1s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qgif.dll
         -3.1s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qicns.dll
         -3.1s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qico.dll
         -3.0s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qjpeg.dll
         -3.0s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qsvg.dll
         -3.0s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qtga.dll
         -3.0s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qtiff.dll
         -3.0s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qwbmp.dll
         -2.9s C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qwebp.dll
         -2.9s C:\Program Files\Malwarebytes\Anti-Malware\platforms\
         -2.9s C:\Program Files\Malwarebytes\Anti-Malware\platforms\qwindows.dll
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\scenegraph\
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\scenegraph\softwarecontext.dll
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\plugins.qmltypes
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\qmldir
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\plugins.qmltypes
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\qmldir
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\qmlsettingsplugin.dll
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\QtQml\
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\
         -2.8s C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\modelsplugin.dll
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\plugins.qmltypes
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\qmldir
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\plugins.qmltypes
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\qmldir
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\qtquickcontrolsplugin.dll
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\qmldir
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\
         -2.7s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\qmldir
         -2.6s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll
         -2.6s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\
         -2.6s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\dialogplugin.dll
         -2.6s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\plugins.qmltypes
         -2.6s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\
         -2.6s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\dialogsprivateplugin.dll
         -2.6s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qmldir
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\plugins.qmltypes
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\qmldir
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\plugins.qmltypes
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\qmldir
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\qtquickextrasplugin.dll
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\plugins.qmltypes
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\qmldir
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\qquicklayoutsplugin.dll
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\plugins.qmltypes
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\qmldir
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\widgetsplugin.dll
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\plugins.qmltypes
         -2.5s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\qmldir
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\windowplugin.dll
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\plugins.qmltypes
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\qmldir
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\qtquick2plugin.dll
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\Languages\
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_en_GB.qm
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_en_US.qm
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_de.qm
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_fr.qm
         -2.4s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_it.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_nl.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_pl.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_pt_BR.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_pt_PT.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_ru.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_sv.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_es.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_da.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_no.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_fi.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_ja.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_hu.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_cs.qm
         -2.3s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_zh_TW.qm
         -2.2s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_ko.qm
         -2.2s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_ro.qm
         -2.2s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_hr.qm
         -2.2s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_sl.qm
         -2.2s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_sk.qm
         -2.2s C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
         -2.2s C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_bg.qm
         -2.1s C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
         -1.9s C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
         -1.5s C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
         -1.3s C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
         -1.3s C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
         -1.2s C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
         -1.1s C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
         -1.1s C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
         -1.0s C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
         -0.9s C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
         -0.8s C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
         -0.7s C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
         -0.7s C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
         -0.6s C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
         -0.1s C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
         -0.1s C:\Program Files\Malwarebytes\Anti-Malware\AeShim.dll
         -0.0s C:\Program Files\Malwarebytes\Anti-Malware\mbae64.dll
          0.0s C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
          0.0s C:\Windows\System32\drivers\mbae64.sys
          0.1s C:\Program Files\Malwarebytes\Anti-Malware\ArwSdkShim.dll
          0.1s C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
          0.2s C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
          0.3s C:\Program Files\Malwarebytes\Anti-Malware\MBAMCore.dll
          0.4s C:\Program Files\Malwarebytes\Anti-Malware\MwacSdkShim.dll
          0.4s C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
          0.5s C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
          0.5s C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
          0.6s C:\Program Files\Malwarebytes\Anti-Malware\RtpShim.dll
          0.6s C:\Program Files\Malwarebytes\Anti-Malware\rtp.dll
          0.7s C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
          0.7s C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
          0.8s C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
          0.8s C:\Program Files\Malwarebytes\Anti-Malware\mbae.dll
          0.8s C:\ProgramData\Malwarebytes\MBAMService\prot.mbdb
          0.8s C:\ProgramData\Malwarebytes\MBAMService\clean.mbdb
          0.8s C:\ProgramData\Malwarebytes\MBAMService\rdefs.mbdb
          0.8s C:\ProgramData\Malwarebytes\MBAMService\rules.mbdb
          1.0s C:\ProgramData\Malwarebytes\MBAMService\scan.mbdb
          1.0s C:\ProgramData\Malwarebytes\MBAMService\tids.mbdb
          1.0s C:\ProgramData\Malwarebytes\MBAMService\wprot.mbdb
          1.1s C:\ProgramData\Malwarebytes\MBAMService\exclusions.txt
          1.2s C:\ProgramData\Malwarebytes\MBAMService\dynconfig.dat
          1.2s C:\ProgramData\Malwarebytes\MBAMService\dbmanifest.dat
          1.2s C:\ProgramData\Malwarebytes\MBAMService\mbdigsig.dat
          1.2s C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
          1.3s C:\Program Files\Malwarebytes\Anti-Malware\libeay32.dll
          1.4s C:\Program Files\Malwarebytes\Anti-Malware\ssleay32.dll
          1.4s C:\Program Files\Malwarebytes\Anti-Malware\zlib.dll
          1.5s C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\
          1.5s C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\Malwarebytes.lnk
          1.7s C:\Users\Public\Desktop\Malwarebytes.lnk
          1.7s C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\Uninstall Malwarebytes.lnk
          1.8s C:\Program Files\Malwarebytes\Anti-Malware\unins000.msg
          1.8s C:\Windows\Prefetch\REGSVR32.EXE-B31EC963.pf
          1.9s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\15\
          1.9s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\15\096EFBDA0B0BE583.dat
          1.9s C:\Windows\Prefetch\MBAMSERVICE.EXE-1DD79AE7.pf
          1.9s C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
          2.0s C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG
          2.0s C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
          2.0s C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
          2.1s C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
          2.4s C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
          2.4s C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
          2.4s C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json
          2.4s C:\Windows\Prefetch\MPCMDRUN.EXE-2C9109F9.pf
          2.5s C:\ProgramData\Malwarebytes\MBAMService\MwacDetections\
          2.5s C:\ProgramData\Malwarebytes\MBAMService\ArwDetections\
          2.5s C:\ProgramData\Malwarebytes\MBAMService\RtpDetections\
          2.5s C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
          2.5s C:\ProgramData\Malwarebytes\MBAMService\ScanResults\
          2.5s C:\ProgramData\Malwarebytes\MBAMService\AeDetections\
          2.6s C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
          2.7s C:\Windows\System32\drivers\MBAMSwissArmy.sys
          2.9s C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
          3.0s C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
          3.1s C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
          3.4s C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
          3.5s C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
          4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\02\5090DF1F0A3D0FEE.dat
          4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\02\
          4.8s C:\Users\K21\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\AppIconCache\100\{6361DDAA-3054-4299-BC80-8121C1251D52}
          5.6s C:\Windows\System32\drivers\mbam.sys
          8.3s C:\Windows\System32\drivers\mwac.sys
          8.3s C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9
          8.3s C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9
          8.3s C:\Windows\System32\drivers\farflt.sys
          8.4s C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5
          8.4s C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5
          8.4s C:\ProgramData\Malwarebytes\MBAMService\ARW\
          8.4s C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.log
          8.4s C:\Windows\Prefetch\MBAMWSC.EXE-2DADCD3B.pf
         10.1s C:\Users\K21\AppData\Local\Temp\mbam\qt-jl-icons\
         10.1s C:\Users\K21\AppData\Local\Temp\mbam\
         10.2s C:\Users\K21\AppData\Local\Temp\mbam\qt-jl-icons\3c4e9e8.ico
         10.2s C:\Users\K21\AppData\Local\Temp\mbam\qt-jl-icons\3c4ea18.ico
         10.2s C:\Users\K21\AppData\Local\Temp\mbam\qt-jl-icons\3c4e838.ico
         10.2s C:\Users\K21\AppData\Local\Temp\mbam\qt-jl-icons\3c4e868.ico
         10.2s C:\Users\K21\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\62e1b2b3b597ba6b.customDestinations-ms
         13.6s C:\Windows\Prefetch\MBAMTRAY.EXE-08C66B4A.pf
         15.6s C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-protector.xpe
         15.6s C:\Windows\System32\drivers\MBAMChameleon.sys
         19.1s C:\Windows\Prefetch\MBAM.EXE-728D2E12.pf
         19.4s C:\Windows\Prefetch\FONTDRVHOST.EXE-8152304A.pf

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=f87c3a05f52e9c4fb330a96d32889e0e
# end=init
# utc_time=2017-05-22 09:56:48
# local_time=2017-05-22 11:56:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 33465
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=f87c3a05f52e9c4fb330a96d32889e0e
# end=updated
# utc_time=2017-05-22 10:01:32
# local_time=2017-05-22 12:01:32 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=f87c3a05f52e9c4fb330a96d32889e0e
# engine=33465
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-05-22 10:25:01
# local_time=2017-05-22 12:25:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 2040 26779315 0 0
# scanned=244671
# found=0
# cleaned=0
# scan_time=1409

Microsoft Meldung Zeus Virus

Plagegeister aller Art und deren Bekämpfung: Microsoft Meldung Zeus Virus

Microsoft Meldung Zeus Virus

Ähnliche Themen: Microsoft Meldung Zeus Virus