Routine-Check

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 18-07-2017
durchgeführt von ** (18-07-2017 23:55:55) Run:1
Gestartet von C:\Users\**\Desktop
Geladene Profile: ** (Verfügbare Profile: defaultuser0 & **)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************

CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ACHTUNG
BHO-x32: Kein Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> Keine Datei
BHO-x32: Kein Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> Keine Datei
RemoveProxy:
EmptyTemp:

*****************

Prozesse erfolgreich geschlossen.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Wert erfolgreich entfernt
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ACHTUNG => erfolgreich wiederhergestellt
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Schlüssel erfolgreich entfernt
HKLM\Software\Wow6432Node\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Schlüssel nicht gefunden. 
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Schlüssel erfolgreich entfernt
HKLM\Software\Wow6432Node\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Schlüssel nicht gefunden. 

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
HKU\S-1-5-21-127803956-1395890586-1919515840-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-127803956-1395890586-1919515840-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt


========= Ende von RemoveProxy: =========


=========== EmptyTemp: ==========

BITS transfer queue => 9199616 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 113573626 B
Java, Flash, Steam htmlcache => 129941123 B
Windows/system/drivers => 2143678 B
Edge => 8431263 B
Chrome => 6849379 B
Firefox => 403942357 B
Opera => 186263682 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 128 B
LocalService => 42485 B
NetworkService => 173106 B
defaultuser0 => 0 B
** => 374169453 B

RecycleBin => 8461954078 B
EmptyTemp: => 9 GB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 23:57:06 ====
         

HitmanPro 3.7.20.286
www.hitmanpro.com

   Computer name . . . . : **-PC
   Windows . . . . . . . : 10.0.0.15063.X64/4
   User name . . . . . . : **-PC\**
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-07-19 00:07:11
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1m 39s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 1
   Traces  . . . . . . . : 3

   Objects scanned . . . : 2.289.942
   Files scanned . . . . : 76.301
   Remnants scanned  . . : 590.566 files / 1.623.075 keys

Malware _____________________________________________________________________

   C:\Users\**\AppData\Local\PunkBuster\BC2\pb\pbcl.dll
      Size . . . . . . . : 891.962 bytes
      Age  . . . . . . . : 189.4 days (2017-01-10 13:40:21)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A324BDA2B890227F72D9F12323AD3FF51582CE312286C296F6558BD3F3927616
    > HitmanPro  . . . . : App/Punkbust-B
      Fuzzy  . . . . . . : 129.0


Suspicious files ____________________________________________________________

   C:\Users\**\Desktop\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.435.584 bytes
      Age  . . . . . . . : 1.0 days (2017-07-17 23:25:39)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : BA7EA1AB41A9E5D73B0D7BFB56F7DBE199AA62C694C883A33F6555810B05FC41
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.

   C:\Users\**\Desktop\FRST64.exe
      Size . . . . . . . : 2.382.336 bytes
      Age  . . . . . . . : 0.0 days (2017-07-18 23:55:41)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 70CEDEBEB419B734436F839E9301CB8664D74E57A3FC8C419E27112FDDE006CD
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\**\Desktop\FRST64.exe
          0.7s C:\Users\**\Desktop\FRST-OlderVersion\
         

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=1393cd09b3c7634e8b67b1f2521722ed
# end=init
# utc_time=2017-07-18 10:09:29
# local_time=2017-07-19 12:09:29 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 34099
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=1393cd09b3c7634e8b67b1f2521722ed
# end=updated
# utc_time=2017-07-18 10:11:36
# local_time=2017-07-19 12:11:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=1393cd09b3c7634e8b67b1f2521722ed
# engine=34099
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-07-19 12:01:19
# local_time=2017-07-19 02:01:19 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 0 10555475 0 0
# scanned=497564
# found=3
# cleaned=0
# scan_time=6582
sh=21C645B4FD6E4FA11312958AE0E50FC953923086 ft=0 fh=0000000000000000 vn="Variante von Win32/FusionCore.K eventuell unerwünschte Anwendung" ac=I fn="C:\Users\**\AppData\Local\Temp\HYD7E21.tmp.1500415417\HTA\install.1500415417.zip"
sh=21C645B4FD6E4FA11312958AE0E50FC953923086 ft=0 fh=0000000000000000 vn="Variante von Win32/FusionCore.K eventuell unerwünschte Anwendung" ac=I fn="C:\Users\**\AppData\Local\Temp\HYDA948.tmp.1500415428\HTA\install.1500415428.zip"