Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
OTL scan auf BKA trojaner

OTL scan auf BKA trojaner


Log-Analyse und Auswertung: OTL scan auf BKA trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 13.02.2018, 06:09   #1
juergen007
 
OTL scan auf BKA trojaner - Standard

OTL scan auf BKA trojaner


Ich ließ wg. eines Hinweises in einem anderen Thread
https://www.trojaner-board.de/121343-logfileauswertung-otl.html mal ein OTL Version 3.2.69.0 laufen mit quick run ohne weitere präparierte Listen. Gibt es diesen BKA trojaner noch? Evtl. weil ich ne uralte Platte von 2011 an usb gehängt habe.
Das kommt mir doch auffälig vor. Ich lasse jetzt noch ein cleanup laufen. Denke das ist damit erledigt, oder?
Danke im voraus
Jürgen

Hier das Log file
Code:
ATTFilter
OTL logfile created on: 13.02.2018 05:46:08 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Administrator\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.18893)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
7,49 Gb Total Physical Memory | 4,62 Gb Available Physical Memory | 61,74% Memory free
11,48 Gb Paging File | 8,36 Gb Available in Paging File | 72,76% Paging File free
Paging file location(s): c:\pagefile.sys 4096 4096 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 488,18 Gb Total Space | 157,76 Gb Free Space | 32,32% Space Free | Partition Type: NTFS
Drive D: | 443,23 Gb Total Space | 149,91 Gb Free Space | 33,82% Space Free | Partition Type: NTFS
Drive F: | 100,00 Mb Total Space | 64,72 Mb Free Space | 64,72% Space Free | Partition Type: NTFS
Drive G: | 351,38 Gb Total Space | 50,38 Gb Free Space | 14,34% Space Free | Partition Type: NTFS
Drive H: | 347,16 Gb Total Space | 44,24 Gb Free Space | 12,74% Space Free | Partition Type: NTFS
Drive I: | 931,51 Gb Total Space | 67,97 Gb Free Space | 7,30% Space Free | Partition Type: NTFS
Drive J: | 931,41 Gb Total Space | 31,67 Gb Free Space | 3,40% Space Free | Partition Type: NTFS
Drive K: | 6,67 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive L: | 3,73 Gb Total Space | 0,04 Gb Free Space | 0,96% Space Free | Partition Type: FAT32
 
Computer Name: JUERGEN2-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2018.02.13 05:42:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
PRC - [2018.02.05 12:08:04 | 000,601,552 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
PRC - [2017.12.12 21:22:32 | 000,055,000 | ---- | M] (Copyright (c) 2017 Plays.tv, LLC) -- C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe
PRC - [2017.11.29 09:11:50 | 003,515,856 | ---- | M] (Malwarebytes) -- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
PRC - [2017.11.14 12:52:42 | 000,288,848 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
PRC - [2017.09.27 11:27:08 | 000,083,984 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2016.08.18 09:27:06 | 000,216,576 | ---- | M] () -- C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
PRC - [2013.02.19 16:38:58 | 000,453,736 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
PRC - [2012.04.11 10:41:04 | 000,097,280 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
PRC - [2012.01.18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - File not found [On_Demand | Stopped] -- C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe -- (TrueKeyServiceHelper)
SRV:64bit: - File not found [Disabled | Stopped] -- C:\Program Files\TrueKey\McTkSchedulerService.exe -- (TrueKeyScheduler)
SRV:64bit: - File not found [Disabled | Stopped] -- C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe -- (TrueKey)
SRV:64bit: - File not found [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.11.667\McCHSvc.exe -- (McComponentHostService)
SRV:64bit: - File not found [Disabled | Stopped] -- C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -- (InstallerService)
SRV:64bit: - [2017.12.29 09:39:36 | 000,116,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2017.11.01 08:07:08 | 006,234,056 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe -- (MBAMService)
SRV:64bit: - [2016.12.12 20:42:54 | 001,471,352 | ---- | M] (Flexera Software LLC) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FlexNet Licensing Service 64)
SRV:64bit: - [2016.11.14 21:14:42 | 000,361,816 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2016.11.14 21:14:42 | 000,119,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2016.08.22 17:19:43 | 001,386,496 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
SRV:64bit: - [2016.05.06 09:51:14 | 003,026,584 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BCA\pabeSvc64.exe -- (IntelBCAsvc)
SRV:64bit: - [2015.08.04 03:06:32 | 000,246,784 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2015.08.04 00:25:00 | 000,344,064 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2013.05.27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2018.02.10 07:54:40 | 000,194,512 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2017.12.12 21:22:32 | 000,055,000 | ---- | M] (Copyright (c) 2017 Plays.tv, LLC) [Auto | Running] -- C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe -- (PlaysService)
SRV - [2017.09.27 11:27:08 | 000,083,984 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2017.08.29 07:57:20 | 010,803,440 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe -- (TeamViewer)
SRV - [2017.04.21 13:53:36 | 000,107,656 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2016.08.18 09:27:06 | 000,216,576 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe -- (DirMngr)
SRV - [2016.03.31 13:03:02 | 000,544,984 | ---- | M] (Visicom Media Inc.) [Disabled | Stopped] -- C:\ProgramData\ManyCam\Service\ManyCamService.exe -- (ManyCam Service)
SRV - [2015.12.01 12:56:07 | 000,090,592 | ---- | M] (Jetico, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe -- (BCWipeSvc)
SRV - [2014.03.20 23:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2012.01.18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - File not found [Kernel | Auto | Stopped] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys -- (AODDriver4.1)
DRV:64bit: - [2018.02.13 05:34:29 | 000,084,256 | ---- | M] (Malwarebytes) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebProtection)
DRV:64bit: - [2018.02.13 05:31:46 | 000,046,008 | ---- | M] (Malwarebytes) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtection)
DRV:64bit: - [2018.02.13 05:31:35 | 000,110,016 | ---- | M] (Malwarebytes) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\farflt.sys -- (MBAMFarflt)
DRV:64bit: - [2018.02.13 05:31:27 | 000,253,880 | ---- | M] (Malwarebytes) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV:64bit: - [2018.02.10 21:01:52 | 000,193,968 | ---- | M] (Malwarebytes) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\MbamChameleon.sys -- (MBAMChameleon)
DRV:64bit: - [2017.11.29 09:11:26 | 000,077,432 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mbae64.sys -- (ESProtectionDriver)
DRV:64bit: - [2016.10.09 18:18:48 | 000,027,384 | ---- | M] (Xilinx, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\xpc4drvr.sys -- (XilinxPC4Driver)
DRV:64bit: - [2016.08.25 09:46:12 | 000,135,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2015.12.01 12:57:52 | 000,042,632 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MftWipeFilter.sys -- (MftWipeFilter)
DRV:64bit: - [2015.11.17 14:40:58 | 000,195,416 | ---- | M] (IDRIX) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\veracrypt.sys -- (veracrypt)
DRV:64bit: - [2015.08.04 07:23:28 | 021,622,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2015.08.04 02:42:28 | 000,665,088 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2015.07.15 11:20:32 | 000,096,256 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2015.05.19 11:35:27 | 000,057,536 | ---- | M] (Jetico Inc. Oy) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\fsh.sys -- (fsh)
DRV:64bit: - [2015.04.03 01:14:26 | 000,229,056 | ---- | M] (AppEx Networks Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\appexDrv.sys -- (APXACC)
DRV:64bit: - [2015.01.15 07:42:24 | 000,977,624 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2014.12.29 05:07:36 | 000,049,304 | ---- | M] (Visicom Media Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcvidrv.sys -- (ManyCam)
DRV:64bit: - [2014.12.29 04:56:08 | 000,035,992 | ---- | M] (Visicom Media Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcaudrv_x64.sys -- (mcaudrv_simple)
DRV:64bit: - [2014.11.24 07:42:17 | 000,094,400 | ---- | M] (Jetico, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\bcswap.sys -- (BCSWAP)
DRV:64bit: - [2014.02.11 17:36:52 | 000,059,616 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\AMD\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.3)
DRV:64bit: - [2013.07.21 18:41:12 | 000,013,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\DRHMSR64.sys -- (DRHMSR64)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.18 06:44:36 | 004,865,568 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:64bit: - [2012.01.18 06:44:28 | 000,351,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2012.01.14 04:05:56 | 000,056,448 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2011.12.13 04:52:44 | 000,082,048 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
DRV:64bit: - [2011.12.13 04:52:44 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
DRV:64bit: - [2011.11.03 19:05:40 | 000,021,984 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\DRHARD64.sys -- (DRHARD64)
DRV:64bit: - [2011.10.26 10:16:46 | 000,219,776 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdxhc.sys -- (amdxhc)
DRV:64bit: - [2011.10.26 10:16:46 | 000,102,528 | ---- | M] (Advanced Micro Devices, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdhub30.sys -- (amdhub30)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 04:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 01:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2013.07.21 18:41:12 | 000,013,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\DRHMSR64.sys -- (DRHMSR64)
DRV - [2011.11.03 19:05:40 | 000,021,984 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\DRHARD64.sys -- (DRHARD64)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-963683855-2343051469-89585254-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page_TIMESTAMP = B1 39 A1 F2 92 66 D2 01  [binary data]
IE - HKU\S-1-5-21-963683855-2343051469-89585254-500\SOFTWARE\Microsoft\Internet Explorer\Main,SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy = Reg Error: Value error.
IE - HKU\S-1-5-21-963683855-2343051469-89585254-500\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-963683855-2343051469-89585254-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
IE - HKU\S-1-5-21-963683855-2343051469-89585254-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.countryCode: "DE"
FF - prefs.js..browser.search.region: "DE"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.search.widget.inNavBar: true
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_137.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.2.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.2.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_137.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll (Google Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 58.0.2\extensions\\Components: C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 58.0.2\extensions\\Plugins: C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 52.6.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 52.6.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2017.01.04 14:15:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Extensions
[2017.11.26 17:20:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\SystemExtensionsDev
[2018.02.12 03:15:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data
[2018.02.13 05:32:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\{a80bbdbb-6fd0-4ee2-ab67-47ef4ba1cede}
[2018.02.06 13:44:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\adguardadblocker@adguard.com
[2018.01.27 12:05:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\artur.dubovoy@gmail.com
[2018.02.07 19:34:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\consistent-https@tanalin.com
[2018.02.13 05:46:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\firefox@ghostery.com
[2018.02.13 05:33:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\jid1-NIfFY2CA8fy1tg@jetpack
[2017.10.19 05:09:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\screenshots@mozilla.org
[2018.02.10 18:53:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\extensions
[2018.02.07 19:38:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\storage\default\moz-extension+++1b1ca62e-9224-41a3-aa76-4b389b9ef786
[2018.02.13 05:43:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\storage\default\moz-extension+++1b1ca62e-9224-41a3-aa76-4b389b9ef786\idb
[2018.02.06 13:43:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\storage\default\moz-extension+++a390d351-cd62-426a-a84b-c588b56d1aad
[2018.02.13 05:37:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\storage\default\moz-extension+++a390d351-cd62-426a-a84b-c588b56d1aad\idb
[2018.02.07 19:36:33 | 000,387,733 | ---- | M] () (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\extensions\artur.dubovoy@gmail.com.xpi
[2018.02.07 19:34:55 | 000,009,834 | ---- | M] () (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\extensions\consistent-https@tanalin.com.xpi
[2018.02.10 18:53:55 | 003,822,716 | ---- | M] () (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\extensions\firefox@ghostery.com.xpi
[2018.02.08 18:39:41 | 001,614,680 | ---- | M] () (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\extensions\https-everywhere@eff.org.xpi
[2018.02.07 19:34:19 | 000,937,042 | ---- | M] () (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\extensions\jid1-NIfFY2CA8fy1tg@jetpack.xpi
[2018.02.07 19:36:59 | 000,577,156 | ---- | M] () (No name found) -- C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\extensions\{a80bbdbb-6fd0-4ee2-ab67-47ef4ba1cede}.xpi
[2018.02.10 07:54:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
 
O1 HOSTS File: ([2018.02.10 18:45:19 | 000,000,035 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-963683855-2343051469-89585254-500..\Run: [AppEx Accelerator UI] C:\Program Files\AMD Quick Stream\AMDQuickStream.exe (AppEx Networks Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPath = 1
O7 - HKU\S-1-5-21-963683855-2343051469-89585254-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: localhost ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: localhost ([]* in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F4DD125-EDDA-44BF-B378-9BAF78A43AC1}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2016.08.27 20:00:05 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.05.06 13:26:23 | 000,000,309 | R--- | M] () - K:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2015.03.19 17:41:06 | 000,000,016 | -H-- | M] () - L:\AUTORUN.INF -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2018.02.13 05:44:23 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2018.02.11 10:50:32 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2018.02.10 21:58:53 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\ESET
[2018.02.10 21:01:52 | 000,193,968 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MbamChameleon.sys
[2018.02.10 21:01:44 | 000,110,016 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\farflt.sys
[2018.02.10 21:01:44 | 000,084,256 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mwac.sys
[2018.02.10 21:01:43 | 000,046,008 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys
[2018.02.10 21:01:33 | 000,253,880 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamswissarmy.sys
[2018.02.10 21:01:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
[2018.02.10 21:01:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes
[2018.02.10 18:54:21 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\VeraCrypt
[2018.02.10 18:45:05 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\FRST-OlderVersion
[2018.02.10 07:57:12 | 002,404,864 | ---- | C] (Farbar) -- C:\Users\Administrator\Desktop\FRST64.exe
[2018.02.08 20:24:04 | 000,000,000 | ---D | C] -- C:\My Files(juergen-PC)
[2018.02.08 18:12:10 | 008,206,624 | ---- | C] (Malwarebytes) -- C:\Users\Administrator\Desktop\adwcleaner_7.0.7.0(3).exe
[2018.02.08 16:01:57 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2018.02.07 10:38:02 | 000,255,928 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\77E7F59C.sys
[2018.02.07 07:41:54 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\mathe
[2018.02.06 19:52:27 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\AppEx Networks
[2018.02.06 18:41:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\.QtWebEngineProcess
[2018.02.06 18:41:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\.Plays.tv
[2018.02.06 18:40:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
[2018.02.06 18:40:13 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\PlaysTV
[2018.02.06 18:38:49 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\library_dir
[2018.02.06 18:38:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Raptr Inc
[2018.02.06 18:37:58 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Raptr
[2018.02.06 18:37:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
[2018.02.06 18:37:37 | 000,229,056 | ---- | C] (AppEx Networks Corporation) -- C:\Windows\SysNative\drivers\appexDrv.sys
[2018.02.06 18:37:37 | 000,000,000 | ---D | C] -- C:\Program Files\AMD Quick Stream
[2018.02.06 18:28:06 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\RadeonInstaller
[2018.02.06 13:49:33 | 000,255,928 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\656387A4.sys
[2018.02.06 13:39:33 | 000,255,928 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\3353E5FC.sys
[2018.02.06 12:25:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2018.02.06 12:25:38 | 000,255,928 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\43221302.sys
[2018.02.06 12:23:37 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\mbar
[2018.02.06 09:00:17 | 000,000,000 | ---D | C] -- C:\daten
[2018.02.06 08:08:52 | 000,000,000 | ---D | C] -- C:\FRST
[2018.02.05 11:48:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BCWipe
[2018.02.05 11:47:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Jetico
[2018.02.02 15:20:45 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\dvdcss
[2018.02.01 13:05:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
[2018.02.01 13:05:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CrystalDiskInfo
[2018.01.30 20:47:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2018.01.28 23:59:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Firetrust
[2018.01.28 23:58:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Firetrust
[2018.01.27 12:34:15 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Mathematica
[2018.01.27 12:34:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Mathematica
[2018.01.27 12:34:14 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Mathematica
[2018.01.27 12:34:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Documents\Wolfram Mathematica
[2018.01.27 12:34:08 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Wolfram
[2018.01.27 12:30:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica 11.2
[2018.01.27 12:27:23 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\OpenOffice
[2018.01.27 12:17:35 | 000,000,000 | ---D | C] -- C:\Program Files\Wolfram Research
[2018.01.27 12:00:12 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Wolfram Research
[2018.01.18 14:27:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
[2018.01.18 14:27:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2018.02.13 05:46:22 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2018.02.13 05:46:22 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2018.02.13 05:42:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2018.02.13 05:34:29 | 000,084,256 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mwac.sys
[2018.02.13 05:31:46 | 000,046,008 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys
[2018.02.13 05:31:35 | 000,110,016 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\farflt.sys
[2018.02.13 05:31:27 | 000,253,880 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamswissarmy.sys
[2018.02.13 05:30:03 | 000,000,021 | ---- | M] () -- C:\Windows\S.dirmngr
[2018.02.13 05:29:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2018.02.13 05:29:48 | 1733,324,799 | -HS- | M] () -- C:\hiberfil.sys
[2018.02.11 21:56:42 | 000,852,720 | ---- | M] () -- C:\Users\Administrator\Desktop\SecurityCheck.exe
[2018.02.11 11:46:13 | 000,781,790 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2018.02.11 11:46:13 | 000,653,930 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2018.02.11 11:46:13 | 000,121,802 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2018.02.10 21:01:52 | 000,193,968 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MbamChameleon.sys
[2018.02.10 21:01:27 | 000,001,835 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes.lnk
[2018.02.10 18:45:19 | 000,000,035 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2018.02.10 18:45:05 | 002,404,864 | ---- | M] (Farbar) -- C:\Users\Administrator\Desktop\FRST64.exe
[2018.02.08 18:10:25 | 008,206,624 | ---- | M] (Malwarebytes) -- C:\Users\Administrator\Desktop\adwcleaner_7.0.7.0(3).exe
[2018.02.08 16:03:16 | 000,002,182 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth Pro.lnk
[2018.02.08 16:02:01 | 000,002,048 | ---- | M] () -- C:\Users\Public\Desktop\Google Slides.lnk
[2018.02.08 16:02:01 | 000,002,046 | ---- | M] () -- C:\Users\Public\Desktop\Google Sheets.lnk
[2018.02.08 16:02:01 | 000,002,036 | ---- | M] () -- C:\Users\Public\Desktop\Google Docs.lnk
[2018.02.07 10:38:02 | 000,255,928 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\77E7F59C.sys
[2018.02.07 07:45:36 | 000,022,284 | ---- | M] () -- C:\Users\Administrator\Desktop\23.jpg
[2018.02.07 07:43:01 | 000,008,189 | ---- | M] () -- C:\Users\Administrator\Desktop\export_reply_3.nb
[2018.02.06 18:41:00 | 000,002,015 | ---- | M] () -- C:\Users\Public\Desktop\Raptr.lnk
[2018.02.06 13:49:33 | 000,255,928 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\656387A4.sys
[2018.02.06 13:39:33 | 000,255,928 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\3353E5FC.sys
[2018.02.06 12:25:38 | 000,255,928 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\43221302.sys
[2018.02.06 11:38:52 | 000,291,024 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2018.02.05 11:39:23 | 000,001,167 | ---- | M] () -- C:\Windows\SysWow64\Reinigung.cmd
[2018.02.05 11:39:23 | 000,001,167 | ---- | M] () -- C:\Windows\SysNative\Reinigung.cmd
[2018.02.01 13:35:05 | 000,137,345 | ---- | M] () -- C:\Users\Administrator\Documents\crystalI.jpg
[2018.02.01 13:33:46 | 000,135,651 | ---- | M] () -- C:\Users\Administrator\Documents\crystalCD.jpg
[2018.02.01 13:21:03 | 000,133,093 | ---- | M] () -- C:\Users\Administrator\Documents\crystal.jpg
[2018.02.01 13:05:44 | 000,001,196 | ---- | M] () -- C:\Users\Administrator\Desktop\CrystalDiskInfo.lnk
[2018.01.19 14:22:06 | 000,765,656 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2018.01.18 14:27:44 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2018.01.15 11:23:58 | 000,001,302 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2018.02.13 05:30:03 | 000,000,021 | ---- | C] () -- C:\Windows\S.dirmngr
[2018.02.11 21:59:09 | 000,852,720 | ---- | C] () -- C:\Users\Administrator\Desktop\SecurityCheck.exe
[2018.02.10 21:01:27 | 000,001,835 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes.lnk
[2018.02.10 21:01:23 | 000,077,432 | ---- | C] () -- C:\Windows\SysNative\drivers\mbae64.sys
[2018.02.08 16:03:16 | 000,002,220 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
[2018.02.08 16:03:16 | 000,002,182 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth Pro.lnk
[2018.02.07 12:49:25 | 1733,324,799 | -HS- | C] () -- C:\hiberfil.sys
[2018.02.07 07:44:01 | 000,022,284 | ---- | C] () -- C:\Users\Administrator\Desktop\23.jpg
[2018.02.07 07:43:01 | 000,008,189 | ---- | C] () -- C:\Users\Administrator\Desktop\export_reply_3.nb
[2018.02.06 18:41:00 | 000,002,015 | ---- | C] () -- C:\Users\Public\Desktop\Raptr.lnk
[2018.02.06 09:28:27 | 000,001,820 | ---- | C] () -- C:\Windows\SysNative\Wartung.cmd
[2018.02.06 09:28:27 | 000,001,167 | ---- | C] () -- C:\Windows\SysNative\Reinigung.cmd
[2018.02.01 13:35:05 | 000,137,345 | ---- | C] () -- C:\Users\Administrator\Documents\crystalI.jpg
[2018.02.01 13:33:46 | 000,135,651 | ---- | C] () -- C:\Users\Administrator\Documents\crystalCD.jpg
[2018.02.01 13:21:03 | 000,133,093 | ---- | C] () -- C:\Users\Administrator\Documents\crystal.jpg
[2018.02.01 13:05:44 | 000,001,196 | ---- | C] () -- C:\Users\Administrator\Desktop\CrystalDiskInfo.lnk
[2018.02.01 12:01:42 | 000,001,820 | ---- | C] () -- C:\Windows\SysWow64\Wartung.cmd
[2018.02.01 12:01:42 | 000,001,167 | ---- | C] () -- C:\Windows\SysWow64\Reinigung.cmd
[2018.01.18 14:27:37 | 000,002,077 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2017.12.21 16:25:58 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\CSVSpecialProcessing.dll
[2017.12.21 16:25:58 | 000,102,400 | ---- | C] () -- C:\Windows\SysWow64\SARzilla.dll
[2017.12.21 16:25:58 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\DVM2.dll
[2017.12.21 16:25:58 | 000,000,530 | ---- | C] () -- C:\Windows\SysWow64\tx13_ic.ini
[2017.08.09 13:58:31 | 000,518,144 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2017.07.20 19:34:39 | 000,003,584 | ---- | C] () -- C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2018.01.01 03:18:30 | 014,183,936 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2018.01.01 03:00:12 | 012,880,384 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2017.10.24 16:13:40 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\.kde
[2017.10.24 16:17:13 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Electrum
[2017.01.04 14:38:36 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GHISLER
[2018.02.11 11:40:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\gnupg
[2017.01.04 19:10:48 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\IrfanView
[2018.02.06 18:38:49 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\library_dir
[2017.12.27 06:17:30 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Notepad++
[2018.01.27 12:27:23 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\OpenOffice
[2017.12.12 15:38:05 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\PilotEdit
[2018.02.06 22:02:21 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\PlaysTV
[2018.02.06 22:02:21 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Raptr
[2017.01.04 14:15:18 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Thunderbird
[2018.02.10 18:54:21 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\VeraCrypt
[2016.09.04 10:42:38 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\.kde
[2016.01.20 13:47:35 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\AMD
[2016.07.13 12:37:52 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\AVG
[2015.12.07 17:47:48 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Canon
[2016.08.10 07:59:05 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\ChessBase
[2016.06.24 15:29:04 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\DVI
[2018.02.05 20:47:02 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Electrum
[2018.01.28 23:59:54 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Firetrust
[2016.02.23 11:00:47 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Forte
[2016.12.15 20:10:39 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\fp
[2016.08.17 05:08:18 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\GeoGebra 5.0
[2016.10.25 19:40:47 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\GHISLER
[2018.01.26 12:50:18 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\gnupg
[2016.07.15 11:35:26 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Grisoft
[2017.06.05 18:26:43 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\I2P
[2018.02.05 18:04:14 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\IrfanView
[2015.11.01 09:47:33 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\library_dir
[2016.06.15 12:21:44 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\ManyCam
[2016.04.28 13:03:18 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Mathematik alpha 2016
[2015.11.05 16:27:54 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Notepad++
[2015.11.22 23:15:36 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\OpenOffice
[2017.06.21 18:59:15 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Opera Software
[2017.12.05 20:53:47 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\PilotEdit
[2018.02.07 05:35:12 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\PlaysTV
[2018.02.07 05:35:40 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Raptr
[2017.12.21 16:27:21 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\SoftInterface, Inc
[2017.10.30 17:46:13 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\TeamViewer
[2015.11.05 16:39:42 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Thunderbird
[2015.11.17 12:13:32 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\TrueCrypt
[2016.06.24 07:06:37 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\TuneUp Software
[2015.11.18 13:37:07 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\VeraCrypt
[2017.06.21 19:42:18 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\VS Revo Group
[2016.12.12 20:45:32 | 000,000,000 | ---D | M] -- C:\Users\juergen2\AppData\Roaming\Xilinx
 
========== Purity Check ==========
 
 

< End of report >

 

Themen zu OTL scan auf BKA trojaner
administrator, adobe, bho, canon, cdrom, defender, error, explorer, explorer.exe, firefox, format, google, malwarebytes, microsoft, mozilla, opera, realtek, registry, scan, security, software, system32, trojaner, usb, windows, winlogon


« Crack Virus? - Windows Explorer crashte! (Trojan.IGENERIC) | Verdächtige aktivitäten auf meinem PC, werbung weiterleitung sowie unbefugte Zugriffe? »


Ähnliche Themen: OTL scan auf BKA trojaner


  1. Windows Vista: 17 infizierte Dateien nach Eset Scan + schwarzer Desktop nach GMER-Scan
    Log-Analyse und Auswertung - 18.10.2015 (23)
  2. Sophos Scan bricht ab - W32/DCmem-A muss vor dem Fortsetzen des Scan-Vorgangs bereinigt werden
    Antiviren-, Firewall- und andere Schutzprogramme - 24.06.2015 (18)
  3. Avira Scan, Trojaner TR/Crypt.ZPACK.50636 gefunden, Fehlalarm oder echter Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 04.12.2014 (17)
  4. Windows 7 Starter: Avast Scan meldet Rootkits, bei zweitem Scan keine mehr
    Log-Analyse und Auswertung - 25.09.2014 (18)
  5. Scan mit Farbars Recovery Scan Tool durchgeführt, was mache ich jetzt?
    Log-Analyse und Auswertung - 14.02.2014 (1)
  6. McAfee Echtzeit Scan deaktiviert, PC-Scan nicht möglich
    Log-Analyse und Auswertung - 01.11.2013 (7)
  7. Windows 8: McAfee Echtzeit-Scan lässt sich nicht aktiveren, keine normaler Scan möglich
    Log-Analyse und Auswertung - 29.09.2013 (19)
  8. Win7 - Startseite Firefox auf QV06 umgeleitet - Scan u. Desinfektion mit MbAM, nun weitere Funde nach online-Scan mit ESET
    Log-Analyse und Auswertung - 24.08.2013 (9)
  9. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2013 Ran by Verena (administrator) on 24-07-2013 20:57:45 Running f
    Mülltonne - 24.07.2013 (1)
  10. Trojaner Verdacht, MBR scan log
    Log-Analyse und Auswertung - 31.05.2013 (5)
  11. Laptop immer langsamer, absturz, OTL scan abgestürzt, gmer scan > Systemabsturz - HILFE!
    Plagegeister aller Art und deren Bekämpfung - 06.02.2013 (3)
  12. OTL Scan bei BKA Trojaner
    Plagegeister aller Art und deren Bekämpfung - 19.12.2012 (6)
  13. BKA-Trojaner, OTL-Scan mit Fehlermeldung
    Log-Analyse und Auswertung - 14.08.2012 (3)
  14. Vecna Scan & TCP FIN Scan im DHCP Clientlogbuch
    Log-Analyse und Auswertung - 04.04.2011 (2)
  15. Mein Scan Log für Trojaner
    Mülltonne - 21.10.2008 (1)
  16. 53 Viren, Trojaner, ... mit e-Scan
    Log-Analyse und Auswertung - 22.06.2008 (1)
  17. 53 Viren, Trojaner, ... mit e-Scan
    Mülltonne - 22.06.2008 (0)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema OTL scan auf BKA trojaner - Ich ließ wg. eines Hinweises in einem anderen Thread https://www.trojaner-board.de/121343-logfileauswertung-otl.html mal ein OTL Version 3.2.69.0 laufen mit quick run ohne weitere präparierte Listen. Gibt es diesen BKA trojaner noch? Evtl. - OTL scan auf BKA trojaner...
Archiv
Du betrachtest: OTL scan auf BKA trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131