| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Stark verseuchter PC--> gleich formatieren?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
07.09.2010, 20:18
| #1 |
 |  Stark verseuchter PC--> gleich formatieren? hallo alle zusammen! ich sags gleich: bin ziemlich schlampig mit meinem PC umgegangen und dementsprechend ist er stark mit allem möglichen verseucht! ich habe 2 scanc genutzt einmal "Malwarebytes" und einmal "Loaris TrojanRemover".... wo bei "Malwarebytes" mir nur 15 viren anzeigt und "Loaris TrojanRemover" 114 anzeigt !!!! soll ich gleich formatieren oder ist der pc noch zu retten? hier ist der Report von Malwarebytes: 07.09.2010 20:58:02 mbam-log-2010-09-07 (20-57-55).txt Scan-Methode: Quick-Scan Durchsuchte Objekte: 78387 Laufzeit: 14 minute(s), 31 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 9 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 0 Infizierte Dateien: 4 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvnzpiejlne (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvdsbhfngqd (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvnzpiejlpe (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvdsbhfngoh (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvnzpiejlpsc (Trojan.Downloader) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvdsbhfngosf (Trojan.Downloader) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvnzpiejlppf (Password.Stealer) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvdsbhfngpta (Password.Stealer) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WINID (Malware.Trace) -> No action taken. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken. Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\xxx\AppData\Local\Temp\lsass.exe (Trojan.Agent) -> No action taken. c:\Users\xxx\AppData\Local\Temp\csrss.exe (Trojan.Agent) -> No action taken. c:\Users\xxx\AppData\Local\Temp\taskmgr.exe (Trojan.Downloader) -> No action taken. c:\Users\xxx\AppData\Local\Temp\services.exe (Password.Stealer) -> No action taken. hier der "Loaris TrojanRemover" scan: Loaris Trojan Remover v.1.2.1.9 Report file date: 07.09.2010 20:41:46 Scanning for 448846 virus strains and unwanted programs. Licensed: UNREGISTERED Windows version: Windows Vista (TM) Home Premium (version 6.0) Username: Sebastian Computer name: SEBASTIAN-PC Starting the file scan: Hijack.NoFolderOptions - fixed Startup collected BHO plugins collected Service collected ActiveX collected Files collected Scanning process... ----- c:\users\sebast~1\appdata\local\temp\csneowarmx.exe ---- Startup Threat csneowarmx.exe MD5: C82FFDCD8238EB908D2DAFC615224332:48128 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 65 F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:A2FC2D99A957938DE3FD3D2CE557A2E0:7168 .DATA21:603DBDAB178793317BA5538812C7F761:3584 .data1:5AD63CFB90B6D2B64ADB998D4C797056:28160 .tls:00000000000000000000000000000000:0 .idata:FA736174610BBF0CCC67266FCF9F6BE7:2560 .e4355:FF1CE2018AA17FE600FCA636B126DBE4:6144 .rsrc:71A1B6C7FA3B177B745FEB54DCA64DD6:3072 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- c:\users\sebast~1\appdata\local\temp\xdrlac.exe ---- Startup Threat LvNZPiejlqX MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebast~1\appdata\local\temp\czev2jlhli.exe ---- Startup Threat LvNZPiejlnfa MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebast~1\appdata\local\temp\taskmgr.exe ---- Startup Threat LvNZPiejlpsc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\smss.exe ---- Startup Threat LvNZPiejlrf MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\system.exe ---- Startup Threat LvNZPiejlud MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\spoolsv.exe ---- Startup Threat LvNZPiejlrxc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\user.exe ---- Startup Threat LvNZPiejlqf MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\lsass.exe ---- Startup Threat LvNZPiejlne MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\hexdump.exe ---- Startup Threat LvNZPiejlotc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\jliey.exe ---- Startup Threat LvNZPiejlmc MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebast~1\appdata\local\temp\avp.exe ---- Startup Threat LvNZPiejloc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\gdi32.exe ---- Startup Threat LvNZPiejlk+ MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\nvsvc32.exe ---- Startup Threat LvNZPiejlsPc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\hpgym.exe ---- Startup Threat LvNZPiejlme MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebast~1\appdata\local\temp\csrss.exe ---- Startup Threat LvNZPiejlpe MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\sysedit.exe ---- Startup Threat LvNZPiejlupc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\services.exe ---- Startup Threat LvNZPiejlppf MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\debug.exe ---- Startup Threat LvNZPiejlhb MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\s5hgzklvl0.exe ---- Startup Threat LvNZPiejlbuQ MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebast~1\appdata\local\temp\winamp.exe ---- Startup Threat LvNZPiejlqb MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\cmd.exe ---- Startup Threat LvNZPiejlkc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebast~1\appdata\local\temp\eiicrwk4e5.exe ---- Startup Threat LvNZPiejlkt_ MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebastian\appdata\roaming\88d5daeeeeaea11a9121e6e125c97af8\mediafix70700en02.exe ---- Startup Threat mediafix70700en02.exe MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- c:\users\sebast~1\appdata\local\temp\xf7hkna8hcn5d.exe ---- Startup Threat LvNZPiejlcocLST~1\AppData\Local\Temp\xf7hkna8hcn5d.exe MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\taskmgr.exe ---- Startup Threat Lvdsbhfngosf MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\user.exe ---- Startup Threat Lvdsbhfngta MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\hexdump.exe ---- Startup Threat Lvdsbhfngmve MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\system.exe ---- Startup Threat Lvdsbhfnguuc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\spoolsv.exe ---- Startup Threat Lvdsbhfngrvg MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\smss.exe ---- Startup Threat Lvdsbhfngre MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\avp.exe ---- Startup Threat Lvdsbhfngoe MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\gdi32.exe ---- Startup Threat Lvdsbhfngl/ MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\lsass.exe ---- Startup Threat Lvdsbhfngqd MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\nvsvc32.exe ---- Startup Threat LvdsbhfngsfP MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\services.exe ---- Startup Threat Lvdsbhfngpta MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\sysedit.exe ---- Startup Threat Lvdsbhfngupf MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\csrss.exe ---- Startup Threat Lvdsbhfngoh MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\s5hgzklvl0.exe ---- Startup Threat Lvdsbhfngdtfc MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebastian\appdata\local\temp\winamp.exe ---- Startup Threat Lvdsbhfngrrc MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\debug.exe ---- Startup Threat Lvdsbhfnglb MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\cmd.exe ---- Startup Threat Lvdsbhfngnb MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- c:\users\sebastian\appdata\local\temp\eiicrwk4e5.exe ---- Startup Threat LvdsbhfngmtOc MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- c:\users\sebastian\appdata\local\temp\xf7hkna8hcn5d.exe ---- Startup Threat LvdsbhfngqeZNstian\AppData\Local\Temp\xf7hkna8hcn5d.exe MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Program Files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll ---- BHO Threat Dealio Toolbar MD5: 1C87D50F3792BB26F316FC70F7389157:700416 EP: 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 31 03 00 00 FF 75 08 8B 4D 10 8B 55 0C E8 CC FE FF FF 59 5D C2 0C 00 FF 25 4C 73 04 10 CC CC 51 8D 4C 24 08 2B C8 83 E1 0F 03 C1 1B C9 0B C1 59 E9 9A 03 00 00 SEC: .text:2058218935C00F8F9A423EABED85C16E:285696 .rdata:603EB6899A59DC45DF92FF41C1BD5548:98816 .data:284F40A0C00317EE1D6933805135C5B2:15360 .rsrc:832AAF769BC1439DFFFE40BE6A4FF7F5:263168 .reloc:640F6F585B11E58601417BBB23F95FE1:36352 ----- HKCU\Software\Antimalware Doctor Inc\Antimalware Doctor ---- Registry Rogue.AntimalwareDoctor ----- HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor ---- Registry Rogue.AntimalwareDoctor ----- C:\Users\Sebastian\AppData\Roaming\microsoft\internet explorer\quick launch\antimalware doctor.lnk ---- General Rogue.AntimalwareDoctor MD5: B0203455B7BB68B6C15C99E8CB877CEF:1106 EP: 00 SEC: ----- C:\Users\Sebastian\AppData\Roaming\88D5DAEEEEAEA11A9121E6E125C97AF8\mediafix70700en02.exe ---- General Rogue.AntimalwareDoctor ProdVer: 24.0.0.0 FileVer: 0.1.0.0 Name : Company: MS MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\antimalware doctor.lnk ---- General Rogue.AntimalwareDoctor MD5: 7A70C13F1BBE67F8E8E4C4A93C3B647F:1118 EP: 00 SEC: ----- C:\Users\Sebastian\AppData\Roaming\88D5DAEEEEAEA11A9121E6E125C97AF8\mediafix70700en02.exe ---- General Rogue.AntimalwareDoctor ProdVer: 24.0.0.0 FileVer: 0.1.0.0 Name : Company: MS MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\antimalware doctor\antimalware doctor.lnk ---- General Rogue.AntimalwareDoctor MD5: 7A70C13F1BBE67F8E8E4C4A93C3B647F:1118 EP: 00 SEC: ----- C:\Users\Sebastian\AppData\Roaming\88D5DAEEEEAEA11A9121E6E125C97AF8\mediafix70700en02.exe ---- General Rogue.AntimalwareDoctor ProdVer: 24.0.0.0 FileVer: 0.1.0.0 Name : Company: MS MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- C:\Users\Sebastian\Desktop\antimalware doctor.lnk ---- General Rogue.AntimalwareDoctor MD5: D34E2553F60C50131BCDCB04ED3EB6FE:1126 EP: 00 SEC: ----- C:\Users\Sebastian\AppData\Roaming\88D5DAEEEEAEA11A9121E6E125C97AF8\mediafix70700en02.exe ---- General Rogue.AntimalwareDoctor ProdVer: 24.0.0.0 FileVer: 0.1.0.0 Name : Company: MS MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\programs\antimalware doctor\uninstall.lnk ---- General Rogue.AntimalwareDoctor MD5: 892BE03CACABD1D325DD4771F27A0B5D:2108 EP: 00 SEC: ----- C:\Users\Sebastian\AppData\Roaming\88D5DAEEEEAEA11A9121E6E125C97AF8\mediafix70700en02.exe ---- General Rogue.AntimalwareDoctor ProdVer: 24.0.0.0 FileVer: 0.1.0.0 Name : Company: MS MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- HKCU\Software\Antimalware Doctor Inc ---- Registry Rogue ----- C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.exe ---- General Worm.Win32.VB.xb ProdVer: 51.2100.2690 FileVer: 51.2100.2690 Name : Microsoft@ Windows@ Operating System Company: Microsoft Corporation MD5: 74DBD545CF6DC5D006325CC3E4658A12:20480 RIC: 15A174CDE9DA79A059C2F2740EBFFBCA:296 EP: 68 BC 13 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 1A A8 B2 5A B4 BA AC 49 80 81 C5 5C 75 7A C9 AC 00 00 00 00 00 00 01 00 00 00 B9 A4 B3 CC 31 2E B9 A4 B3 CC 31 SEC: .text  7AE2192CACFD8D7F5DCED4C2AF98BBB:12288.data:00000000000000000000000000000000:0 .rsrc:CCBC7228083B598F70C50621E6C142D5:4096 ----- C:\Users\Sebastian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HK9RLV0C\mediafix70700en02[1].exe ---- General Mal/Fraud!se579 ProdVer: 24.0.0.0 FileVer: 0.1.0.0 Name : Company: MS MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- C:\Users\Sebastian\AppData\Local\Temp\202fbh.exe ---- General Mal/VB-CF MD5: 489CFD601E2EA73C8E01B66A0C2CF395:34304 EP: 60 BE 00 A0 41 00 8D BE 00 70 FE FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 9C F2 01 00 57 83 C3 04 53 68 24 74 00 00 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 55 SEC: UPX0:00000000000000000000000000000000:0 UPX1:AA370D90151E9BB8642E260434C940B6:32768 .rsrc:74DB92CB1444E08FAEE35590A56E078A:512 ----- C:\Users\Sebastian\AppData\Local\Temp\br8oc.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\csneowarmx.exe ---- General Mal/Fraud!se579 MD5: C82FFDCD8238EB908D2DAFC615224332:48128 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 65 F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:A2FC2D99A957938DE3FD3D2CE557A2E0:7168 .DATA21:603DBDAB178793317BA5538812C7F761:3584 .data1:5AD63CFB90B6D2B64ADB998D4C797056:28160 .tls:00000000000000000000000000000000:0 .idata:FA736174610BBF0CCC67266FCF9F6BE7:2560 .e4355:FF1CE2018AA17FE600FCA636B126DBE4:6144 .rsrc:71A1B6C7FA3B177B745FEB54DCA64DD6:3072 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- C:\Users\Sebastian\AppData\Local\Temp\czev2jlhli.exe ---- General Mal/Packer!se5 MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\dl3b5ixpg5.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\Sebastian\AppData\Local\Temp\fwj3e05io.exe ---- General Packer.Upack!se ProdVer: 5.2.3790.3990 FileVer: 5.2.3790.3990 Name : Company: MD5: 2946145873AFB0DDCA822E9F1C239590:212347 RIC: BB953344F1C28A2CA9948B2B30033984:744 EP: 60 E8 09 00 00 00 05 F7 0C 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 SEC: .Upack:00000000000000000000000000000000:0 .rsrc:8B08113CE94EF2A170DEC2721B576128:211835 ----- C:\Users\Sebastian\AppData\Local\Temp\g1xwc.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\Sebastian\AppData\Local\Temp\hpgym.exe ---- General Mal/Packer!se5 MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\i8btkjerp.exe ---- General Packer.Upack!se ProdVer: 5.2.3790.3990 FileVer: 5.2.3790.3990 Name : Company: MD5: B4AFA1DF1DEBB6C5A8ECE7D0A4793BED:212347 RIC: BB953344F1C28A2CA9948B2B30033984:744 EP: 60 E8 09 00 00 00 05 F7 0C 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 SEC: .Upack:00000000000000000000000000000000:0 .rsrc:9953741DD43AE119B9506E44DF5CAAD7:211835 ----- C:\Users\Sebastian\AppData\Local\Temp\iexplorer.exe ---- General Mal/Packer!se5 MD5: 2EC72C79D802600B9EE9BC658F41E5E9:2368 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :1706E375A7BB25F2C8265C3C78A9A3D9:1856 ----- C:\Users\Sebastian\AppData\Local\Temp\ik2el.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\Sebastian\AppData\Local\Temp\jd0sz.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\Sebastian\AppData\Local\Temp\jliey.exe ---- General Mal/Packer!se5 MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\jov87t0nk9uuh8.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\Sebastian\AppData\Local\Temp\l1ympa95jwo.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\Sebastian\AppData\Local\Temp\lvo98uy1.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\mdm.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\Sebastian\AppData\Local\Temp\q4jon5.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\Sebastian\AppData\Local\Temp\rdybyqnt9e5k4.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\Sebastian\AppData\Local\Temp\sxarecomnw.exe ---- General Mal/Fraud!se590 ProdVer: 2,9,211,1190 FileVer: Name : C9 H13 N Company: MD5: 12CCEEB6694573A7090E61BAB67502B7:83456 EP: 55 8B EC 51 56 57 33 FF 57 8B 04 E5 20 20 40 00 FF D0 BE C8 00 00 00 8B C6 90 48 0F 85 F8 FF FF FF 6A 0A 57 8D 45 FC 50 50 8B 04 65 14 20 40 00 FF D0 90 FF CE 0F 85 F7 FF FF FF 8B 45 0C 33 C9 68 SEC: .text:38AEF7B6328012093984FAED8FEF9A8F:3584 .rdata:7592129ECE0B0D7E7A7908AD63BEAB51:3584 .data:9619A2D1AB4E764F4520CF87637D7387:5120 .xpi:0F343B0931126A20F133D67C2B018A3B:1024 .ixp:BF619EAC0CDF3F68D496EA9344137E8B:512 .pixi:0F343B0931126A20F133D67C2B018A3B:1024 .rsrc:A6E3A41E603D097D5C08BF28F17F25B5:67072 .reloc:13DB68D8388D2982E0869EDFAB3D94D6:512 ----- C:\Users\Sebastian\AppData\Local\Temp\tbcwy2r.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\tbe1rp.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\tjhgnt.exe ---- General Mal/Packer!se5 MD5: 584998016369CACAA34795D73555F842:31696 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :C16A867CEB110C0A97B151CDB63257EA:31184 ----- C:\Users\Sebastian\AppData\Local\Temp\tpcuqc.exe ---- General Mal/Packer!se5 MD5: 584998016369CACAA34795D73555F842:31696 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :C16A867CEB110C0A97B151CDB63257EA:31184 ----- C:\Users\Sebastian\AppData\Local\Temp\w4269.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\Sebastian\AppData\Local\Temp\wb0q1w28.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\wemnocxars.exe ---- General Mal/Fraud!se590 ProdVer: 2,9,211,1190 FileVer: Name : C9 H13 N Company: MD5: 12CCEEB6694573A7090E61BAB67502B7:83456 EP: 55 8B EC 51 56 57 33 FF 57 8B 04 E5 20 20 40 00 FF D0 BE C8 00 00 00 8B C6 90 48 0F 85 F8 FF FF FF 6A 0A 57 8D 45 FC 50 50 8B 04 65 14 20 40 00 FF D0 90 FF CE 0F 85 F7 FF FF FF 8B 45 0C 33 C9 68 SEC: .text:38AEF7B6328012093984FAED8FEF9A8F:3584 .rdata:7592129ECE0B0D7E7A7908AD63BEAB51:3584 .data:9619A2D1AB4E764F4520CF87637D7387:5120 .xpi:0F343B0931126A20F133D67C2B018A3B:1024 .ixp:BF619EAC0CDF3F68D496EA9344137E8B:512 .pixi:0F343B0931126A20F133D67C2B018A3B:1024 .rsrc:A6E3A41E603D097D5C08BF28F17F25B5:67072 .reloc:13DB68D8388D2982E0869EDFAB3D94D6:512 ----- C:\Users\Sebastian\AppData\Local\Temp\wsb019.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\Sebastian\AppData\Local\Temp\ww6kxsa7n8i.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\Sebastian\AppData\Local\Temp\xdrlac.exe ---- General Mal/Packer!se5 MD5: 6204938E0003046C711CF0367972C1A8:30001 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Temp\xgduscdu.exe ---- General TrojanDownloader ProdVer: 2, 4, 0, 1 FileVer: 2, 1, 0, 5 Name : NDIS VPN Company: SecureNet MD5: FE422471EEAC8B490DF54E6FC97EC326:19968 RIC: 22A095A2C8FA19BEE7F33040DBFD8F02:744 EP: 55 8B EC 81 EC C8 01 00 00 57 56 83 65 D8 00 53 6A 00 6A 00 6A 00 6A 00 6A 00 FF 15 7C C1 40 00 2D 00 00 07 80 BA C5 61 40 00 01 C2 8B 12 83 E8 57 21 45 FC 83 E1 00 81 F1 00 70 40 00 89 4D F4 8D SEC: .textbs:00000000000000000000000000000000:0 .text:82F375DBD0169C5423567C8A8B84C613:1024 .data:6F03B502C1618F3917FB3878D9D02999:1024 .rsrc B195679DDDBBFAA89D515632F816E35:9728.debug:EFFDE7E9659C7D99EADBAACD39169CA7:1024 .idata:38593EAB52968CBC986DE4FD88FB3659:6144 ----- C:\Users\Sebastian\AppData\Local\Temp\zwzdtr1o.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\Sebastian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HK9RLV0C\mediafix70700en02[1].exe ---- General Mal/Fraud!se579 ProdVer: 24.0.0.0 FileVer: 0.1.0.0 Name : Company: MS MD5: 882F962538B5D8920A04515CC7C113EB:1063424 EP: 90 8B 0C 24 33 C0 48 66 40 0F 8E 2B F6 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SEC: .text:E35C022AFFB925291C2953F76CFF4A00:7168 .DATA21:174AD8CF66128F94520A87314A8A60A4:3584 .data1:FBAE68DEE04CB5925BFB073A0B86364A:1040896 .tls:00000000000000000000000000000000:0 .idata:C62BFB7522294D3F9F9424D85A963CDF:2560 .e4355:BF619EAC0CDF3F68D496EA9344137E8B:512 .rsrc:B0AF1A0BC0F79CCD267A859A83AFEA5B:11264 .wdata:BF619EAC0CDF3F68D496EA9344137E8B:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\202fbh.exe ---- General Mal/VB-CF MD5: 489CFD601E2EA73C8E01B66A0C2CF395:34304 EP: 60 BE 00 A0 41 00 8D BE 00 70 FE FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 9C F2 01 00 57 83 C3 04 53 68 24 74 00 00 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 55 SEC: UPX0:00000000000000000000000000000000:0 UPX1:AA370D90151E9BB8642E260434C940B6:32768 .rsrc:74DB92CB1444E08FAEE35590A56E078A:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\br8oc.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\SEBAST~1\AppData\Local\Temp\dl3b5ixpg5.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\SEBAST~1\AppData\Local\Temp\fwj3e05io.exe ---- General Packer.Upack!se ProdVer: 5.2.3790.3990 FileVer: 5.2.3790.3990 Name : Company: MD5: 2946145873AFB0DDCA822E9F1C239590:212347 RIC: BB953344F1C28A2CA9948B2B30033984:744 EP: 60 E8 09 00 00 00 05 F7 0C 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 SEC: .Upack:00000000000000000000000000000000:0 .rsrc:8B08113CE94EF2A170DEC2721B576128:211835 ----- C:\Users\SEBAST~1\AppData\Local\Temp\g1xwc.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\i8btkjerp.exe ---- General Packer.Upack!se ProdVer: 5.2.3790.3990 FileVer: 5.2.3790.3990 Name : Company: MD5: B4AFA1DF1DEBB6C5A8ECE7D0A4793BED:212347 RIC: BB953344F1C28A2CA9948B2B30033984:744 EP: 60 E8 09 00 00 00 05 F7 0C 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 SEC: .Upack:00000000000000000000000000000000:0 .rsrc:9953741DD43AE119B9506E44DF5CAAD7:211835 ----- C:\Users\SEBAST~1\AppData\Local\Temp\iexplorer.exe ---- General Mal/Packer!se5 MD5: 2EC72C79D802600B9EE9BC658F41E5E9:2368 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :1706E375A7BB25F2C8265C3C78A9A3D9:1856 ----- C:\Users\SEBAST~1\AppData\Local\Temp\ik2el.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\jd0sz.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\jov87t0nk9uuh8.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\SEBAST~1\AppData\Local\Temp\l1ympa95jwo.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\SEBAST~1\AppData\Local\Temp\lvo98uy1.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\SEBAST~1\AppData\Local\Temp\mdm.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 101C553D501BF206CE3B84E6B3EDF952:60004 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\SEBAST~1\AppData\Local\Temp\q4jon5.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\rdybyqnt9e5k4.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\SEBAST~1\AppData\Local\Temp\sxarecomnw.exe ---- General Mal/Fraud!se590 ProdVer: 2,9,211,1190 FileVer: Name : C9 H13 N Company: MD5: 12CCEEB6694573A7090E61BAB67502B7:83456 EP: 55 8B EC 51 56 57 33 FF 57 8B 04 E5 20 20 40 00 FF D0 BE C8 00 00 00 8B C6 90 48 0F 85 F8 FF FF FF 6A 0A 57 8D 45 FC 50 50 8B 04 65 14 20 40 00 FF D0 90 FF CE 0F 85 F7 FF FF FF 8B 45 0C 33 C9 68 SEC: .text:38AEF7B6328012093984FAED8FEF9A8F:3584 .rdata:7592129ECE0B0D7E7A7908AD63BEAB51:3584 .data:9619A2D1AB4E764F4520CF87637D7387:5120 .xpi:0F343B0931126A20F133D67C2B018A3B:1024 .ixp:BF619EAC0CDF3F68D496EA9344137E8B:512 .pixi:0F343B0931126A20F133D67C2B018A3B:1024 .rsrc:A6E3A41E603D097D5C08BF28F17F25B5:67072 .reloc:13DB68D8388D2982E0869EDFAB3D94D6:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\tbcwy2r.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\SEBAST~1\AppData\Local\Temp\tbe1rp.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\SEBAST~1\AppData\Local\Temp\tjhgnt.exe ---- General Mal/Packer!se5 MD5: 584998016369CACAA34795D73555F842:31696 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :C16A867CEB110C0A97B151CDB63257EA:31184 ----- C:\Users\SEBAST~1\AppData\Local\Temp\tpcuqc.exe ---- General Mal/Packer!se5 MD5: 584998016369CACAA34795D73555F842:31696 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :C16A867CEB110C0A97B151CDB63257EA:31184 ----- C:\Users\SEBAST~1\AppData\Local\Temp\w4269.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\wb0q1w28.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 ----- C:\Users\SEBAST~1\AppData\Local\Temp\wemnocxars.exe ---- General Mal/Fraud!se590 ProdVer: 2,9,211,1190 FileVer: Name : C9 H13 N Company: MD5: 12CCEEB6694573A7090E61BAB67502B7:83456 EP: 55 8B EC 51 56 57 33 FF 57 8B 04 E5 20 20 40 00 FF D0 BE C8 00 00 00 8B C6 90 48 0F 85 F8 FF FF FF 6A 0A 57 8D 45 FC 50 50 8B 04 65 14 20 40 00 FF D0 90 FF CE 0F 85 F7 FF FF FF 8B 45 0C 33 C9 68 SEC: .text:38AEF7B6328012093984FAED8FEF9A8F:3584 .rdata:7592129ECE0B0D7E7A7908AD63BEAB51:3584 .data:9619A2D1AB4E764F4520CF87637D7387:5120 .xpi:0F343B0931126A20F133D67C2B018A3B:1024 .ixp:BF619EAC0CDF3F68D496EA9344137E8B:512 .pixi:0F343B0931126A20F133D67C2B018A3B:1024 .rsrc:A6E3A41E603D097D5C08BF28F17F25B5:67072 .reloc:13DB68D8388D2982E0869EDFAB3D94D6:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\wsb019.dll ---- General Trojan-Downloader.Win32.Frethog MD5: A8DA7AE99BF483F4A2AF8B4C14F67A8B:30000 EP: 80 7C 24 08 01 0F 85 B9 01 00 00 60 BE 00 90 00 10 8D BE 00 80 FF FF 57 83 CD FF EB 0D 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC SEC: UPX0:00000000000000000000000000000000:0 UPX1:F72EF2EB49A3B1ECB29FC187B41FD8AF:3584 UPX2:6E6366F8501500F0AA91D8BDD1ABA644:512 ----- C:\Users\SEBAST~1\AppData\Local\Temp\ww6kxsa7n8i.exe ---- General Mal/Packer!se5 ProdVer: FileVer: 1.0 Name : Company: Microsoft Corporation MD5: 52CC7161683B552777033136E60CE5A9:60000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :ADE75ACFAD8616FA2CDC8080A986844C:20992 ----- C:\Users\SEBAST~1\AppData\Local\Temp\xgduscdu.exe ---- General TrojanDownloader ProdVer: 2, 4, 0, 1 FileVer: 2, 1, 0, 5 Name : NDIS VPN Company: SecureNet MD5: FE422471EEAC8B490DF54E6FC97EC326:19968 RIC: 22A095A2C8FA19BEE7F33040DBFD8F02:744 EP: 55 8B EC 81 EC C8 01 00 00 57 56 83 65 D8 00 53 6A 00 6A 00 6A 00 6A 00 6A 00 FF 15 7C C1 40 00 2D 00 00 07 80 BA C5 61 40 00 01 C2 8B 12 83 E8 57 21 45 FC 83 E1 00 81 F1 00 70 40 00 89 4D F4 8D SEC: .textbs:00000000000000000000000000000000:0 .text:82F375DBD0169C5423567C8A8B84C613:1024 .data:6F03B502C1618F3917FB3878D9D02999:1024 .rsrc B195679DDDBBFAA89D515632F816E35:9728.debug:EFFDE7E9659C7D99EADBAACD39169CA7:1024 .idata:38593EAB52968CBC986DE4FD88FB3659:6144 ----- C:\Users\SEBAST~1\AppData\Local\Temp\zwzdtr1o.exe ---- General Mal/Packer!se5 MD5: A539C9A43BD46146DA2376F1D5650B79:30000 EP: BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC SEC: :00000000000000000000000000000000:0 :50B46E7BEC256D4DFFE0532AAFB87500:3072 Scan completed! Scan result: 114 detected items Scan completed in: Scan completed in 21 minute(s) 22 sec. Files were scanned: 12243 danke sehr im voraus! |
| Themen zu Stark verseuchter PC--> gleich formatieren? |
| avp.exe, dateien, desktop, detected, explorer, file, formatieren, hijack.folderoptions, home, home premium, iexplorer.exe, internet, internet explorer, launch, local\temp, lsass.exe, malwarebytes, mdm.exe, microsoft, opera, password.stealer, secure, services.exe, software, start menu, system, temp, trojan.agent, viren, virus, vista, windows |
Baum-Darstellung