Hallo zusammen,
ich habe das Problem gehabt, das manche Internetseiten nicht geladen wurden.
Bin dann folgende Anleitung durchgegangen https://www.trojaner-board.de/182440-seitenladefehler-bestimmten-zeitraum.html. Bis zu dem Schritt mit HitmanPro wurden keine Funde verzeichnet.
HitmanPro hat jetzt eine Maleware gefunden. Ich bitte daher um Hilfe wie ich diese Mailware entfernen soll. Ich denke mal nicht mit HitmanPro sondern manuell?
Das log von HitmanPro findet ihr anbei. Über eine Hilfe würde ich mich freuen.
Schöne Grüße
Benjamin
PHP-Code:
[code]
HitmanPro 3.7.20.286
www.hitmanpro.com
Computer name . . . . : NEUERPC-BENJI
Windows . . . . . . . : 6.1.1.7601.X64/4
User name . . . . . . : NEUERPC-BENJI\Admin
UAC . . . . . . . . . : Enabled
License . . . . . . . : Free
Scan date . . . . . . : 2017-10-09 21:53:08
Scan mode . . . . . . : Normal
Scan duration . . . . : 11m 2s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 1
Traces . . . . . . . : 7
Objects scanned . . . : 2.115.399
Files scanned . . . . : 83.709
Remnants scanned . . : 663.921 files / 1.367.769 keys
Malware _____________________________________________________________________
C:\Users\Benjamin\AppData\Local\PunkBuster\WF\pb\pbcl.dll
Size . . . . . . . : 951.565 bytes
Age . . . . . . . : 1156.3 days (2014-08-10 15:50:36)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 28FDCBC64DEB82D8A64A4770F2B616CE5E95B4751BBE6FA459DD2B64A12298CF
> HitmanPro . . . . : App/Punkbust-B
Fuzzy . . . . . . : 129.0
Suspicious files ____________________________________________________________
C:\Users\Benjamin\AppData\Local\PunkBuster\WF\pb\PnkBstrK.sys
Size . . . . . . . : 139.128 bytes
Age . . . . . . . : 1156.3 days (2014-08-10 15:50:48)
Entropy . . . . . : 7.7
SHA-256 . . . . . : DD1DC609F49E1D61C5269CEBAA7603EFD9BDD5234A3D1C46A2F34EE637A6061D
Fuzzy . . . . . . : 29.0
The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Program contains PE structure anomalies. This is not typical for most programs.
The file is a device driver. Device drivers run as trusted (highly privileged) code.
C:\Users\Benjamin\Desktop\FRST64.exe
Size . . . . . . . : 2.401.792 bytes
Age . . . . . . . : 0.1 days (2017-10-09 18:33:34)
Entropy . . . . . : 7.6
SHA-256 . . . . . : D8929E59BAAB29BE46FF37CBA69E65EFAABD43929805787D103707707C6E9B1B
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
References
HKU\S-1-5-21-1736300720-3261459200-3707274600-1003\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Users\Benjamin\Desktop\FRST64.exe
C:\Users\Benjamin\Downloads\FRST64.exe
Size . . . . . . . : 2.435.584 bytes
Age . . . . . . . : 98.3 days (2017-07-03 14:33:57)
Entropy . . . . . : 7.6
SHA-256 . . . . . : EEB86294D4428CF1671E2227DA8D3C5C68F7BB15FC7FD78E87F3973C31D46F8A
Needs elevation . : Yes
Fuzzy . . . . . . : 22.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Potential Unwanted Programs _________________________________________________
C:\Users\Benjamin\AppData\Local\VNT\ (AskBar)
C:\Users\Benjamin\AppData\Local\VNT\vntsrv.dll (AskBar)
Size . . . . . . . : 92.672 bytes
Age . . . . . . . : 1359.4 days (2014-01-19 12:11:36)
Entropy . . . . . : 6.2
SHA-256 . . . . . : 1A545675F7C8937A31CB3F7512E253660E3ADA637160E549F21595F7A0893B97
Product . . . . . : Virtual New Tab
Publisher . . . . : APN LLC.
Description . . . : Virtual New Tab Server
Version . . . . . : 1.2.0.3294
Copyright . . . . : (c) APN LLC. All rights reserved.
LanguageID . . . . : 1033
Fuzzy . . . . . . : 0.0
[/code]
09.10.2017, 21:15
Baum-Darstellung