| Achillia | 11.11.2013 22:11 |
grr. die ganze Antwort weg wegen irgendeinem "security tokken" (oder so)..,.
nochmals: Ich habe immer wieder Probleme der Anweisung "Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren." zu folgen. Bei meinem PC kriege ich den Avira nicht beendet und beim Notebook jetzt den Microsoft Security irgendwas. Letzteres konnte ich wenigstens über die Prozesse beenden. Er ist jetzt bei 24%, aber hat schon wieder 1 infiziertes File gefunden, unglaublich. Als Microsoft Security sich meldete, hat er auch ca. 4 verseuchte Sachen gefunden. Mal sehen, wann der wirklich sauber ist :D.
Ihc poste die Logs jedenfalls, sobald der Scan fertig ist (dürte noch dauern, das ganze rennt seit 5:31h).
LG,
Achillia Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e1fd0be5e4449644b2c2ea752fc6185a
# engine=15835
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-11 06:59:43
# local_time=2013-11-11 07:59:43 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 10541639 135826233 0 0
# scanned=165216
# found=1
# cleaned=0
# scan_time=20231
sh=59FC8C44773EB76472B49A54CB47F923612CD455 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Svenja\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\50d90483-69a12476"
Security Check ging nicht: Code:
UNSUPPORTED OPERATING SYSTEM! ABORTED!
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by Svenja (administrator) on SVENJA-HP on 11-11-2013 22:06:50
Running from C:\Users\Svenja\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
() C:\Users\Svenja\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-08-12] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
MountPoints2: F - F:\AutoRun.exe
MountPoints2: {3c96e197-dadc-11e0-8d9f-2c27d7dfe20f} - F:\AutoRun.exe
MountPoints2: {3c96e19b-dadc-11e0-8d9f-2c27d7dfe20f} - F:\AutoRun.exe
MountPoints2: {44151e12-0ef0-11e1-8840-2c27d7dfe20f} - G:\AutoRun.exe
MountPoints2: {6adb9a52-dd6f-11e0-bf8b-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {dbbe230a-eaa5-11e1-8b21-2c27d7dfe20f} - F:\AutoRun.exe
MountPoints2: {f3a7dd6c-f7ed-11e1-abe9-2c27d7dfe20f} - F:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gmx.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/1
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {74406B9E-00CC-4325-8BEE-B2BAEFC75CD0} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-05-14] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
==================== Services (Whitelisted) =================
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-08-12] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-08-12] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S1 cxdvossc; C:\Windows\system32\drivers\cxdvossc.sys [49872 2013-11-11] (Microsoft Corporation)
S3 MosIrUsb; C:\Windows\System32\DRIVERS\MosIrUsb.sys [27648 2007-10-11] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-11 22:05 - 2013-11-11 22:04 - 00891184 _____ C:\Users\Svenja\Desktop\SecurityCheck.exe
2013-11-11 18:38 - 2013-11-11 18:38 - 00049872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cxdvossc.sys
2013-11-11 14:18 - 2013-11-11 14:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-10 19:20 - 2013-11-10 19:21 - 00013519 _____ C:\Users\Svenja\Desktop\Addition.txt
2013-11-10 19:20 - 2013-11-10 19:20 - 01957590 _____ (Farbar) C:\Users\Svenja\Desktop\FRST64.exe
2013-11-10 19:01 - 2013-11-10 19:01 - 01957562 _____ (Farbar) C:\Users\Svenja\Downloads\FRST64.exe
2013-11-10 18:59 - 2013-11-10 18:59 - 00003061 _____ C:\Users\Svenja\Desktop\JRT.txt
2013-11-10 18:53 - 2013-11-10 18:53 - 00000000 ____D C:\Windows\ERUNT
2013-11-10 18:53 - 2013-11-10 17:28 - 01034531 _____ (Thisisu) C:\Users\Svenja\Desktop\JRT.exe
2013-11-10 17:58 - 2013-11-10 18:48 - 00000000 ____D C:\AdwCleaner
2013-11-10 17:51 - 2013-11-10 17:27 - 01073262 _____ C:\Users\Svenja\Desktop\adwcleaner.exe
2013-11-10 17:31 - 2013-11-10 17:31 - 00001113 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-10 17:31 - 2013-11-10 17:31 - 00000000 ____D C:\Users\Svenja\AppData\Roaming\Malwarebytes
2013-11-10 17:31 - 2013-11-10 17:31 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-10 17:30 - 2013-11-10 17:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-10 17:30 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-08 23:52 - 2013-11-08 23:52 - 00000000 ____D C:\FRST
==================== One Month Modified Files and Folders =======
2013-11-11 22:04 - 2013-11-11 22:05 - 00891184 _____ C:\Users\Svenja\Desktop\SecurityCheck.exe
2013-11-11 19:44 - 2011-06-14 00:41 - 01317672 _____ C:\Windows\WindowsUpdate.log
2013-11-11 18:38 - 2013-11-11 18:38 - 00049872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cxdvossc.sys
2013-11-11 18:38 - 2012-09-04 12:56 - 00000000 ____D C:\Windows\pss
2013-11-11 18:35 - 2011-09-09 15:29 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{336D194D-BADE-4EC2-B661-8457E6D759C5}
2013-11-11 17:13 - 2013-05-11 18:52 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForSvenja
2013-11-11 17:13 - 2013-05-11 18:52 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForSvenja.job
2013-11-11 14:18 - 2013-11-11 14:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-10 19:21 - 2013-11-10 19:20 - 00013519 _____ C:\Users\Svenja\Desktop\Addition.txt
2013-11-10 19:20 - 2013-11-10 19:20 - 01957590 _____ (Farbar) C:\Users\Svenja\Desktop\FRST64.exe
2013-11-10 19:18 - 2009-07-14 05:51 - 00091425 _____ C:\Windows\setupact.log
2013-11-10 19:01 - 2013-11-10 19:01 - 01957562 _____ (Farbar) C:\Users\Svenja\Downloads\FRST64.exe
2013-11-10 18:59 - 2013-11-10 18:59 - 00003061 _____ C:\Users\Svenja\Desktop\JRT.txt
2013-11-10 18:57 - 2009-07-14 05:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-10 18:57 - 2009-07-14 05:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-10 18:55 - 2011-05-15 06:15 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-11-10 18:55 - 2011-05-15 06:15 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-11-10 18:55 - 2009-07-14 06:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-10 18:53 - 2013-11-10 18:53 - 00000000 ____D C:\Windows\ERUNT
2013-11-10 18:49 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-10 18:48 - 2013-11-10 17:58 - 00000000 ____D C:\AdwCleaner
2013-11-10 17:31 - 2013-11-10 17:31 - 00001113 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-10 17:31 - 2013-11-10 17:31 - 00000000 ____D C:\Users\Svenja\AppData\Roaming\Malwarebytes
2013-11-10 17:31 - 2013-11-10 17:31 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-10 17:31 - 2013-11-10 17:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-10 17:28 - 2013-11-10 18:53 - 01034531 _____ (Thisisu) C:\Users\Svenja\Desktop\JRT.exe
2013-11-10 17:27 - 2013-11-10 17:51 - 01073262 _____ C:\Users\Svenja\Desktop\adwcleaner.exe
2013-11-09 14:12 - 2011-09-09 15:15 - 00000000 ____D C:\Users\Svenja
2013-11-08 23:52 - 2013-11-08 23:52 - 00000000 ____D C:\FRST
2013-11-07 19:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-16 20:50 - 2012-09-05 07:16 - 00001912 _____ C:\Windows\epplauncher.mif
2013-10-16 20:50 - 2012-09-05 07:15 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-16 20:50 - 2012-09-05 07:15 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-10-16 19:40 - 2009-07-14 05:45 - 00276904 _____ C:\Windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Svenja\AppData\Local\Temp\Extract.exe
C:\Users\Svenja\AppData\Local\Temp\Quarantine.exe
C:\Users\Svenja\AppData\Local\Temp\SP52509.exe
C:\Users\Svenja\AppData\Local\Temp\XrHRlJa.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-10 18:16
==================== End Of Log ============================
--- --- ---
--- --- ---
Naja, wie schon geschrieben, dieses Eset hat infizierte Dateien gefunden und Microsoft Security hat auch angeschlagen und mehr als diese eine Datei gefunden (ich habe jetzt mal extra nichts gemacht...). Eset habe ich deshalb noch nicht deinstalliert.
LG,
Achillia | 
+ R Taste und schreibe notepad in das Ausführen Fenster.
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
SecurityCheck und:
