Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   BKA Trojaner 2014 (https://www.trojaner-board.de/154285-bka-trojaner-2014-a.html)

Casadras 23.05.2014 23:34
BKA Trojaner 2014
 
Hallo , mich hat es nun leider auch erwischt das BKA Virus .
Falls mir jemand helfen kann wäre das toll habe das Log angefügt.
Vielen Dank für die Hilfe

Bootsektor 23.05.2014 23:36
:hallo:

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.


Schritt 1
Bitte poste dein Log hier in CodeTags

Casadras 23.05.2014 23:44
FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:23-05-2014
Ran by SYSTEM on MININT-RPKED56 on 23-05-2014 23:35:58
Running from F:\
Platform: Windows 7 Ultimate (X86) OS Language: Polish
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


ATTENTION!:=====> THE OPERATING SYSTEM IS A X64 SYSTEM BUT THE BOOT DISK THAT IS USED TO BOOT TO RECOVERY ENVIRONMENT IS A X86 SYSTEM DISK.



==================== Registry (Whitelisted) ==================

HKU\K2\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55360 2014-05-15] (Raptr, Inc)
AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL => C:\ProgramData\Wincert\win64cert.dll [8704 2013-09-22] ()
AppInit_DLLs:  C:\PROGRA~2\MOVIES~1\SAFETY~1\x64\SAFETY~2.DLL => C:\PROGRA~2\MOVIES~1\SAFETY~1\x64\SAFETY~2.DLL File Not Found
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
Startup: C:\Users\K2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\PROGRA~3\8BBBC3~1\gn1rflrf.cpp (No File)
HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\SafetyNut\safetycrt.dll
HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\SafetyNut\x64\safetycrt.dll

========================== Services (Whitelisted) =================

S2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
S2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432 2013-12-21] (Adobe Systems Incorporated)
S3 AdobeFlashPlayerUpdateSvc; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [257712 2014-05-14] (Adobe Systems Incorporated)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-04-17] (Advanced Micro Devices, Inc.)
S2 AODService; C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [136544 2010-03-12] ()
S2 Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55144 2011-10-09] (Apple Inc.)
S3 aspnet_state; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [51648 2012-07-08] (Microsoft Corporation)
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-28] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-28] (BonanzaDeals)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
S3 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
S2 clr_optimization_v4.0.30319_64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [123856 2012-07-08] (Microsoft Corporation)
S3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-05] (Microsoft Corporation)
S2 gupdate; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [136176 2010-11-15] (Google Inc.)
S3 gupdatem; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [136176 2010-11-15] (Google Inc.)
S3 gusvc; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2012-08-12] (Google)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [253568 2009-11-18] (Hewlett-Packard Co.)
S2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [137344 2009-11-18] (Hewlett-Packard Co.)
S2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1043584 2010-01-29] (Hewlett-Packard Co.)
S3 idsvc; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe [856400 2010-11-05] (Microsoft Corporation)
S2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [705136 2014-04-11] (Cherished Technololgy LIMITED)
S2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
S4 NetMsmqActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139696 2012-07-08] (Microsoft Corporation)
S4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139696 2012-07-08] (Microsoft Corporation)
S4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139696 2012-07-08] (Microsoft Corporation)
S4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [139696 2012-07-08] (Microsoft Corporation)
S3 odserv; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
S3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-14] (Microsoft Corporation)
S2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [177704 2007-06-05] ()
S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
S2 SkypeUpdate; C:\Program Files (x86)\Skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2011-12-17] (Creative Labs)
S3 Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [571816 2014-01-27] (Valve Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
S2 TeamViewer9; C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [4915040 2014-02-17] (TeamViewer GmbH)
S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2099512 2013-10-30] (TuneUp Software)
S2 Update RightSurf; C:\Program Files (x86)\RightSurf\updateRightSurf.exe [317728 2014-05-21] ()
S2 Util RightSurf; C:\Program Files (x86)\RightSurf\bin\utilRightSurf.exe [317728 2014-05-23] ()
S2 WajamUpdater; C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [109064 2013-04-22] (Wajam)
S2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [425104 2014-02-26] (Taiwan Shui Mu Chih Ching Technology Limited.)
S3 WiselinkPro; C:\Program Files (x86)\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe [3007488 2010-02-17] ()
S2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [501904 2014-02-26] (Cherished Technololgy LIMITED)
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [X]
S2 Winmgmt; C:\PROGRA~3\8BBBC3405DE74398515ADCA1EBAB1DA4\frlfr1ng.dot [X]

==================== Drivers (Whitelisted) ====================

S2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [191616 2010-02-24] (Protect Software GmbH)
S3 amdiox64; C:\Windows\System32\DRIVERS\amdiox64.sys [46136 2010-02-18] (Advanced Micro Devices)
S3 AODDriver; C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver.sys [52280 2010-03-12] (Advanced Micro Devices)
S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S3 AtcL001; C:\Windows\System32\DRIVERS\l160x64.sys [58368 2009-06-25] (Atheros Communications, Inc.)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [94720 2013-12-19] (Advanced Micro Devices)
S3 b06bdrv; C:\Windows\system32\DRIVERS\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
S3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHD64.sys [2267552 2010-02-08] (Realtek Semiconductor Corp.)
S3 ksthunk; C:\Windows\system32\drivers\ksthunk.sys [20992 2009-07-14] (Microsoft Corporation)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [76912 2010-08-24] (Atheros Communications, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [55280 2009-07-09] (Sonic Solutions)
S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2012-08-16] (Duplex Secure Ltd.)
S3 TASCAM_US122144; C:\Windows\System32\Drivers\tascusb2.sys [409664 2010-06-18] (TASCAM)
S3 TASCAM_US122L_MK2_WDM; C:\Windows\System32\drivers\tscusb2a.sys [50240 2010-06-18] (TASCAM)
S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [51712 2011-08-02] (Apple, Inc.)
S1 wStLibG64; C:\Windows\System32\drivers\wStLibG64.sys [61112 2014-03-14] (StdLib)
S3 cpuz130; \??\C:\Users\K2\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-23 22:52 - 2014-05-23 23:35 - 00000000 ____D () C:\FRST
2014-05-23 22:14 - 2014-05-23 22:16 - 00001444 _____ () C:\ProgramData\RUNDLL32.EXE-2784-F.txt
2014-05-23 06:18 - 2014-05-23 06:18 - 00000481 _____ () C:\ProgramData\RUNDLL32.EXE-896-F.txt
2014-05-23 05:33 - 2014-05-23 05:40 - 00004456 _____ () C:\ProgramData\RUNDLL32.EXE-2184-F.txt
2014-05-23 00:44 - 2014-05-23 00:47 - 00002016 _____ () C:\ProgramData\RUNDLL32.EXE-2460-F.txt
2014-05-22 19:21 - 2014-05-22 19:22 - 00000917 _____ () C:\ProgramData\RUNDLL32.EXE-3588-F.txt
2014-05-22 19:16 - 2014-05-22 19:18 - 00001709 _____ () C:\ProgramData\RUNDLL32.EXE-2612-F.txt
2014-05-22 19:10 - 2014-05-22 19:13 - 00002160 _____ () C:\ProgramData\RUNDLL32.EXE-3960-F.txt
2014-05-22 19:03 - 2014-05-23 23:33 - 00000000 ____D () C:\ProgramData\8BBBC3405DE74398515ADCA1EBAB1DA4
2014-05-20 23:41 - 2014-05-20 23:41 - 00000000 ____D () C:\Wie man freunde
2014-05-20 23:33 - 2014-05-20 23:33 - 00000000 ____D () C:\Users\K2\Downloads\Dale Carnegie - Wie man Freunde gewinnt
2014-05-20 21:46 - 2014-05-20 22:20 - 151174816 _____ () C:\Users\K2\Downloads\DarnegieFreunDSHareClouD.part2.rar
2014-05-20 17:32 - 2014-05-20 17:45 - 103383040 _____ () C:\Users\K2\Downloads\DarnegieFreunDSHareClouD.part1.rar
2014-05-16 19:28 - 2014-05-16 19:28 - 00000000 ____D () C:\Users\K2\Documents\Anno 1404
2014-05-16 18:42 - 2014-05-16 18:42 - 00000000 ____D () C:\Anno
2014-05-13 18:33 - 2012-08-28 13:27 - 00058536 _____ (Advanced Micro Devices) C:\Windows\System32\Drivers\usbfilter.sys
2014-05-07 19:58 - 2014-05-07 19:58 - 00000000 ____D () C:\Users\K2\Documents\Banished
2014-05-07 19:53 - 2014-05-07 19:53 - 00001027 _____ () C:\Users\Public\Desktop\Banished 32bit.lnk
2014-05-07 19:53 - 2014-05-07 19:53 - 00001007 _____ () C:\Users\Public\Desktop\Banished 64bit.lnk
2014-05-07 19:52 - 2014-05-07 19:53 - 00000000 ____D () C:\Users\K2\Downloads\Banished 1.0.1 - Elamigos
2014-05-07 19:52 - 2014-05-07 15:16 - 106422505 _____ () C:\Users\K2\Downloads\BANIS.ELA.ETH.rar
2014-04-30 23:54 - 2014-05-11 20:57 - 00000000 ____D () C:\Users\K2\Documents\Battlefield 4
2014-04-30 23:53 - 2014-04-30 23:53 - 03822544 _____ () C:\Users\K2\Downloads\battlelog-web-plugins_2.3.2_134.exe
2014-04-30 22:12 - 2014-04-30 22:12 - 00000000 ____D () C:\ProgramData\ATI
2014-04-30 22:07 - 2014-04-30 22:07 - 00000000 ____D () C:\Users\K2\AppData\Roaming\library_dir
2014-04-30 22:06 - 2014-05-23 22:14 - 00000000 ____D () C:\Users\K2\AppData\Roaming\Raptr
2014-04-30 22:06 - 2014-04-30 22:06 - 00067160 _____ () C:\Windows\SysWOW64\CCCInstall_201404302306311003.log
2014-04-30 22:04 - 2014-04-30 22:06 - 00000000 ____D () C:\Program Files\AMD
2014-04-30 22:03 - 2014-04-30 22:03 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-04-30 21:58 - 2014-04-30 22:06 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-04-30 21:35 - 2014-04-30 21:35 - 00001194 _____ () C:\Users\Public\Desktop\Battlefield 4.lnk
2014-04-30 21:35 - 2014-04-30 21:35 - 00001170 _____ () C:\Users\Public\Desktop\Battlefield 4(64 bit).lnk
2014-04-30 21:33 - 2014-04-30 21:33 - 269338400 _____ (AMD Inc.) C:\Users\K2\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-04-30 21:32 - 2014-05-13 18:28 - 00000000 ____D () C:\ProgramData\Package Cache

==================== One Month Modified Files and Folders =======

2014-05-23 23:35 - 2014-05-23 22:52 - 00000000 ____D () C:\FRST
2014-05-23 23:33 - 2014-05-22 19:03 - 00000000 ____D () C:\ProgramData\8BBBC3405DE74398515ADCA1EBAB1DA4
2014-05-23 22:16 - 2014-05-23 22:14 - 00001444 _____ () C:\ProgramData\RUNDLL32.EXE-2784-F.txt
2014-05-23 22:14 - 2014-04-30 22:06 - 00000000 ____D () C:\Users\K2\AppData\Roaming\Raptr
2014-05-23 22:13 - 2013-12-07 13:26 - 00091404 _____ () C:\Windows\setupact.log
2014-05-23 06:18 - 2014-05-23 06:18 - 00000481 _____ () C:\ProgramData\RUNDLL32.EXE-896-F.txt
2014-05-23 06:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\LogFiles
2014-05-23 06:17 - 2002-01-01 00:43 - 01454709 _____ () C:\Windows\WindowsUpdate.log
2014-05-23 06:16 - 2009-07-14 05:45 - 00014016 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-23 06:16 - 2009-07-14 05:45 - 00014016 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-23 05:40 - 2014-05-23 05:33 - 00004456 _____ () C:\ProgramData\RUNDLL32.EXE-2184-F.txt
2014-05-23 00:47 - 2014-05-23 00:44 - 00002016 _____ () C:\ProgramData\RUNDLL32.EXE-2460-F.txt
2014-05-22 19:22 - 2014-05-22 19:21 - 00000917 _____ () C:\ProgramData\RUNDLL32.EXE-3588-F.txt
2014-05-22 19:18 - 2014-05-22 19:16 - 00001709 _____ () C:\ProgramData\RUNDLL32.EXE-2612-F.txt
2014-05-22 19:13 - 2014-05-22 19:10 - 00002160 _____ () C:\ProgramData\RUNDLL32.EXE-3960-F.txt
2014-05-22 19:00 - 2009-07-14 03:34 - 00000713 _____ () C:\Windows\win.ini
2014-05-20 23:41 - 2014-05-20 23:41 - 00000000 ____D () C:\Wie man freunde
2014-05-20 23:33 - 2014-05-20 23:33 - 00000000 ____D () C:\Users\K2\Downloads\Dale Carnegie - Wie man Freunde gewinnt
2014-05-20 22:20 - 2014-05-20 21:46 - 151174816 _____ () C:\Users\K2\Downloads\DarnegieFreunDSHareClouD.part2.rar
2014-05-20 17:45 - 2014-05-20 17:32 - 103383040 _____ () C:\Users\K2\Downloads\DarnegieFreunDSHareClouD.part1.rar
2014-05-19 17:12 - 2011-12-04 15:26 - 00000000 ____D () C:\Users\K2\AppData\Roaming\Ubisoft
2014-05-18 11:20 - 2013-12-08 12:33 - 00157476 _____ () C:\Windows\PFRO.log
2014-05-16 19:28 - 2014-05-16 19:28 - 00000000 ____D () C:\Users\K2\Documents\Anno 1404
2014-05-16 18:51 - 2013-12-12 23:27 - 00107184 _____ () C:\Windows\DirectX.log
2014-05-16 18:42 - 2014-05-16 18:42 - 00000000 ____D () C:\Anno
2014-05-16 18:42 - 2010-09-25 12:41 - 00000000 ____D () C:\users\K2
2014-05-16 05:33 - 2011-04-09 13:07 - 00000000 ____D () C:\Users\K2\AppData\Roaming\HpUpdate
2014-05-15 19:10 - 2011-03-22 23:49 - 00002385 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-15 05:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64
2014-05-14 22:10 - 2011-12-09 18:08 - 00000000 ____D () C:\ProgramData\Origin
2014-05-14 18:05 - 2012-04-25 21:01 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 18:05 - 2011-11-11 20:28 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-13 22:48 - 2010-11-15 22:59 - 00000000 ____D () C:\Users\K2\AppData\Roaming\Skype
2014-05-13 18:28 - 2014-04-30 21:32 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-11 21:02 - 2009-07-14 04:20 - 00000000 ___RD () C:\Program Files (x86)
2014-05-11 20:57 - 2014-04-30 23:54 - 00000000 ____D () C:\Users\K2\Documents\Battlefield 4
2014-05-07 19:58 - 2014-05-07 19:58 - 00000000 ____D () C:\Users\K2\Documents\Banished
2014-05-07 19:53 - 2014-05-07 19:53 - 00001027 _____ () C:\Users\Public\Desktop\Banished 32bit.lnk
2014-05-07 19:53 - 2014-05-07 19:53 - 00001007 _____ () C:\Users\Public\Desktop\Banished 64bit.lnk
2014-05-07 19:53 - 2014-05-07 19:52 - 00000000 ____D () C:\Users\K2\Downloads\Banished 1.0.1 - Elamigos
2014-05-07 19:52 - 2014-02-26 21:22 - 00000000 ____D () C:\Users\K2\AppData\Roaming\WinZipper
2014-05-07 19:51 - 2009-07-14 06:13 - 01625714 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-07 18:10 - 2012-09-09 18:14 - 00000000 ____D () C:\Users\Public\CyberLink
2014-05-07 18:10 - 2012-06-19 18:21 - 00000000 ____D () C:\Users\K2\AppData\Roaming\CyberLink
2014-05-07 15:16 - 2014-05-07 19:52 - 106422505 _____ () C:\Users\K2\Downloads\BANIS.ELA.ETH.rar
2014-05-03 17:20 - 2013-06-20 18:17 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-05-03 17:11 - 2010-10-21 22:28 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-05-02 20:45 - 2013-10-16 18:18 - 00000000 _____ () C:\end
2014-05-02 06:14 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-04-30 23:58 - 2010-10-29 18:39 - 00000000 ____D () C:\Users\K2\AppData\Local\PunkBuster
2014-04-30 23:53 - 2014-04-30 23:53 - 03822544 _____ () C:\Users\K2\Downloads\battlelog-web-plugins_2.3.2_134.exe
2014-04-30 22:12 - 2014-04-30 22:12 - 00000000 ____D () C:\ProgramData\ATI
2014-04-30 22:07 - 2014-04-30 22:07 - 00000000 ____D () C:\Users\K2\AppData\Roaming\library_dir
2014-04-30 22:06 - 2014-04-30 22:06 - 00067160 _____ () C:\Windows\SysWOW64\CCCInstall_201404302306311003.log
2014-04-30 22:06 - 2014-04-30 22:04 - 00000000 ____D () C:\Program Files\AMD
2014-04-30 22:06 - 2014-04-30 21:58 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-04-30 22:06 - 2013-12-07 13:27 - 00000000 ____D () C:\ProgramData\AMD
2014-04-30 22:03 - 2014-04-30 22:03 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-04-30 22:00 - 2011-01-29 08:47 - 01599058 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-04-30 21:35 - 2014-04-30 21:35 - 00001194 _____ () C:\Users\Public\Desktop\Battlefield 4.lnk
2014-04-30 21:35 - 2014-04-30 21:35 - 00001170 _____ () C:\Users\Public\Desktop\Battlefield 4(64 bit).lnk
2014-04-30 21:34 - 2013-06-20 18:17 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-04-30 21:33 - 2014-04-30 21:33 - 269338400 _____ (AMD Inc.) C:\Users\K2\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-04-26 21:59 - 2013-06-11 21:17 - 00000000 ____D () C:\SoloApp

Files to move or delete:
====================
C:\Users\K2\AppData\Roaming\skype.dat


Some content of TEMP:
====================
C:\Users\K2\AppData\Local\Temp\rgb.dll
C:\Users\K2\AppData\Local\Temp\tmpB4EF.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2014-02-01 23:06] - [2010-11-20 14:24] - 2872320 ____A (Microsoft Corporation) AC4C51EB24AA95B77F705AB159189E24

C:\Windows\System32\winlogon.exe
[2014-02-01 23:06] - [2010-11-20 14:25] - 0390656 ____A (Microsoft Corporation) 1151B1BAA6F350B1DB6598E0FEA7C457

C:\Windows\System32\wininit.exe
[2009-07-14 00:52] - [2009-07-14 02:39] - 0129024 ____A (Microsoft Corporation) 94355C28C1970635A31B3FE52EB7CEBA

C:\Windows\System32\svchost.exe
[2009-07-14 00:31] - [2009-07-14 02:39] - 0027136 ____A (Microsoft Corporation) C78655BC80301D76ED4FEF1C1EA40A7D

C:\Windows\System32\services.exe
[2009-07-14 00:19] - [2009-07-14 02:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\User32.dll
[2014-02-01 23:06] - [2010-11-20 14:27] - 1008128 ____A (Microsoft Corporation) FE70103391A64039A921DBFFF9C7AB1B

C:\Windows\System32\userinit.exe
[2014-02-01 23:05] - [2010-11-20 14:25] - 0030720 ____A (Microsoft Corporation) BAFE84E637BF7388C96EF48D4D3FDD53

C:\Windows\System32\rpcss.dll
[2014-02-01 23:06] - [2010-11-20 14:27] - 0512000 ____A (Microsoft Corporation) 5C627D1B1138676C0A7AB2C2C190D123

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\Windows\System32\Drivers\volsnap.sys
[2014-02-01 23:06] - [2010-11-20 14:34] - 0295808 ____A (Microsoft Corporation) 0D08D2F3B3FF84E433346669B5E0F639


==================== Restore Points  =========================


==================== Memory info ===========================

Percentage of memory in use: 3%
Total physical RAM: 16379.08 MB
Available physical RAM: 15743.7 MB
Total Pagefile: 16377.36 MB
Available Pagefile: 15751.1 MB
Total Virtual: 2047.88 MB
Available Virtual: 1965.26 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:2.73 GB) NTFS
Drive e: (Windows7PL_ALL_x86_x64_DVD) (CDROM) (Total:3.68 GB) (Free:0 GB) UDF
Drive f: (USB DISK) (Removable) (Total:14.43 GB) (Free:1.4 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EE454B68)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 14 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=14 GB) - (Type=0C)


LastRegBack: 2014-05-19 16:56

==================== End Of Log ============================
--- --- ---

--- --- ---


falls es etwas hilft habe mir das virus am 22.05 nach 18:00 Uhr eingefangen.

Bootsektor 23.05.2014 23:56
Hallo Casadras,

danke :)

Du hast ein offensichtlich ein 64 bit System und verwendest eine 32bit Version von FRST, bitte lade dir die Version für 64 bit Betriebssyteme herunter und mache den Fix dann damit.

Startet der Rechner nach folgendem Fix wieder normal?
Achtung, auch wenn dein Rechner wieder normal startet, hast du weiterhin Malware auf deinem Rechner, arbeite bitte weiter mit!

Schritt 1
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
Startup: C:\Users\K2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\PROGRA~3\8BBBC3~1\gn1rflrf.cpp (No File)
S2 Winmgmt; C:\PROGRA~3\8BBBC3405DE74398515ADCA1EBAB1DA4\frlfr1ng.dot [X]
2014-05-22 19:03 - 2014-05-23 23:33 - 00000000 ____D () C:\ProgramData\8BBBC3405DE74398515ADCA1EBAB1DA4
2014-05-23 05:40 - 2014-05-23 05:33 - 00004456 _____ () C:\ProgramData\RUNDLL32.EXE-2184-F.txt
2014-05-23 00:47 - 2014-05-23 00:44 - 00002016 _____ () C:\ProgramData\RUNDLL32.EXE-2460-F.txt
2014-05-22 19:22 - 2014-05-22 19:21 - 00000917 _____ () C:\ProgramData\RUNDLL32.EXE-3588-F.txt
2014-05-22 19:18 - 2014-05-22 19:16 - 00001709 _____ () C:\ProgramData\RUNDLL32.EXE-2612-F.txt
2014-05-22 19:13 - 2014-05-22 19:10 - 00002160 _____ () C:\ProgramData\RUNDLL32.EXE-3960-F.txt
2014-05-23 22:16 - 2014-05-23 22:14 - 00001444 _____ () C:\ProgramData\RUNDLL32.EXE-2784-F.txt
2014-05-23 06:18 - 2014-05-23 06:18 - 00000481 _____ () C:\ProgramData\RUNDLL32.EXE-896-F.txt
C:\Users\K2\AppData\Roaming\skype.dat
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Casadras 24.05.2014 09:59
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:23-05-2014
Ran by SYSTEM at 2014-05-24 10:31:29 Run:1
Running from F:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
Startup: C:\Users\K2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\PROGRA~3\8BBBC3~1\gn1rflrf.cpp (No File)
S2 Winmgmt; C:\PROGRA~3\8BBBC3405DE74398515ADCA1EBAB1DA4\frlfr1ng.dot [X]
2014-05-22 19:03 - 2014-05-23 23:33 - 00000000 ____D () C:\ProgramData\8BBBC3405DE74398515ADCA1EBAB1DA4
2014-05-23 05:40 - 2014-05-23 05:33 - 00004456 _____ () C:\ProgramData\RUNDLL32.EXE-2184-F.txt
2014-05-23 00:47 - 2014-05-23 00:44 - 00002016 _____ () C:\ProgramData\RUNDLL32.EXE-2460-F.txt
2014-05-22 19:22 - 2014-05-22 19:21 - 00000917 _____ () C:\ProgramData\RUNDLL32.EXE-3588-F.txt
2014-05-22 19:18 - 2014-05-22 19:16 - 00001709 _____ () C:\ProgramData\RUNDLL32.EXE-2612-F.txt
2014-05-22 19:13 - 2014-05-22 19:10 - 00002160 _____ () C:\ProgramData\RUNDLL32.EXE-3960-F.txt
2014-05-23 22:16 - 2014-05-23 22:14 - 00001444 _____ () C:\ProgramData\RUNDLL32.EXE-2784-F.txt
2014-05-23 06:18 - 2014-05-23 06:18 - 00000481 _____ () C:\ProgramData\RUNDLL32.EXE-896-F.txt
C:\Users\K2\AppData\Roaming\skype.dat
*****************

C:\Users\K2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk => Moved successfully.
C:\PROGRA~3\8BBBC3~1\gn1rflrf.cpp not found.
Winmgmt => Service restored successfully.
C:\ProgramData\8BBBC3405DE74398515ADCA1EBAB1DA4 => Moved successfully.
C:\ProgramData\RUNDLL32.EXE-2184-F.txt => Moved successfully.
C:\ProgramData\RUNDLL32.EXE-2460-F.txt => Moved successfully.
C:\ProgramData\RUNDLL32.EXE-3588-F.txt => Moved successfully.
C:\ProgramData\RUNDLL32.EXE-2612-F.txt => Moved successfully.
C:\ProgramData\RUNDLL32.EXE-3960-F.txt => Moved successfully.
C:\ProgramData\RUNDLL32.EXE-2784-F.txt => Moved successfully.
C:\ProgramData\RUNDLL32.EXE-896-F.txt => Moved successfully.
C:\Users\K2\AppData\Roaming\skype.dat => Moved successfully.

==== End of Fixlog ====
Vielen Dank habe nun wieder zugriff auf meinen PC . Habe gerade malwarebytes aktualisiert und einen Suchlauf gestartet.

Bootsektor 24.05.2014 22:09
Hallo Casadras,

ich hatte dich in meinen Regeln gebeten, keine selbstständigen Scans durchzuführen.
Zitat:
Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
Poste mir bitte das Malwarebytes-Log und mache ab jetzt alle Schritte im Normalmodus von Windows

Schritt 1

Verschiebe nun die FRST.exe von deinem USB-Stick auf den Desktop deines Rechners.
Starte jetzt noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:41 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131