Trojaner-Board - "TR/Crypt.ZPACK.Gen" - infiziert? - Entdecken

obwohl ich ja so fremde, UPX gepackte Programme ohne Hersteller/Programmautor und Homepage mit Impressum überhaupt nicht mag.
Auch wenn sie mir von Leuten in Foren gepostet werden, denen ich jetzt gerade mal zwangsweise vertrauen muß.

Zudem, wo ich noch Ersttester des Programms bin :/
https://www.virustotal.com/de/file/5cdd9666356c26729239c5ea199694481b439bea3016d6e581efde7ba8e118b1/analysis/1385974853/

FIRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-12-2013

Ran by Administrator (administrator) on Administrator-PC on 02-12-2013 10:05:16

Running from C:\Downloads

Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 8

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(ghisler) C:\Program Files\TOTAL COMMANDER\TOTALCMD.EXE

(Mozilla Corporation) C:\Program Files\Thunderbird\thunderbird.exe

(Dominik Reichl) C:\Program Files\KeePass-1.26\KeePass.exe

(Sysinternals - www.sysinternals.com) C:\Program Files\Process Explorer  - 11.33.0.0\procexp.exe

(LIGHTNING UK!) C:\Program Files\ImgBurn\ImgBurn.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 2007\Office12\POWERPNT.EXE

(Mozilla Corporation) C:\Program Files\Firefox\firefox.exe

(Jasc Software, Inc.) C:\Program Files\PSP 9\PSP.EXE
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [OutpostMonitor] - C:\Program Files\Agnitum\Outpost Security Suite Pro\op_mon.exe [3448264 2012-12-14] (Agnitum Ltd.)

HKCU\...\Run: [PicPick Start] - C:\Downloads\PIC 6.10.2013\picpick.exe /startup

AppInit_DLLs: C:\Program Files\Agnitum\Outpost Security Suite Pro\wl_hook.dll [ 2012-12-14] (Agnitum Ltd.)
 

==================== Internet (Whitelisted) ====================
 

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c

FF Homepage: user_pref("browser.startup.homepage", "");

FF NetworkProxy: "http", "200.251.200.1"

FF NetworkProxy: "http_port", 8080

FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Extension: Cookie Exporter - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\cookieexporter@krk

FF Extension: Cookie Importer - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\cookieimporter@krk

FF Extension: CookieKiller - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\cookiekiller@joseph.moran

FF Extension: Organize Status Bar - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\{35106bca-6c78-48c7-ac28-56df30b51d2c}

FF Extension: Flashblock - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

FF Extension: FEBE - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}

FF Extension: NoScript - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

FF Extension: PrefBar - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\{8A6C82A1-F6C9-481a-AAE7-C96444C9A754}

FF Extension: CookieCuller - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}

FF Extension: CookieSafe - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2a78d4c\Extensions\{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}
 

========================== Services (Whitelisted) =================
 

R2 acssrv; C:\Program Files\Agnitum\Outpost Security Suite Pro\acs.exe [2317336 2012-12-14] (Agnitum Ltd.)

R2 AVerRemote; C:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe [348160 2010-04-28] (AVerMedia)

R2 AVerScheduleService; C:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe [403456 2011-04-02] ()

R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

S2 ImDskSvc; %SystemRoot%\system32\imdsksvc.exe [x]

S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
 

==================== Drivers (Whitelisted) ====================
 

R1 afw; C:\Windows\System32\DRIVERS\afw.sys [33888 2012-09-03] (Agnitum Ltd.)

R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [338528 2012-12-03] (Agnitum Ltd.)

R3 AVerAF15DMBTH; C:\Windows\System32\Drivers\AVerAF15DMBTH.sys [551296 2010-11-25] (AVerMedia TECHNOLOGIES, Inc.)

S0 giveio; C:\Windows\system32\giveio.sys [5248 1996-04-03] ()

R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)

R1 SandBox; C:\Windows\system32\drivers\SandBox.sys [785800 2012-12-05] (Agnitum Ltd.)

S0 speedfan; C:\Windows\system32\speedfan.sys [24184 2012-12-29] (Almico Software)

S3 VBEngNT; C:\Windows\system32\drivers\VBEngNT.sys [266872 2012-11-20] (VirusBuster Kft.)

S3 VBFilt; C:\Windows\system32\Filt\VBFilt.dll [84608 2012-12-05] (Agnitum Ltd.)

S3 AWEAlloc; system32\DRIVERS\awealloc.sys [x]

S2 ImDisk; system32\DRIVERS\imdisk.sys [x]

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-12-02 10:03 - 2013-12-02 10:03 - 00000000 ____D C:\FRST

2013-12-02 08:46 - 2013-12-02 08:46 - 00000032 _____ C:\Windows\Menu.INI

2013-11-30 22:22 - 2013-11-30 23:32 - 00000000 ____D C:\POWERPOINT 2011

2013-11-30 22:12 - 2013-12-01 00:13 - 00000000 ____D C:\BRENN ES

2013-11-28 07:55 - 2013-11-28 08:00 - 00000000 ____D C:\Users\Max\AppData\Roaming\GHISLER

2013-11-24 23:27 - 2013-11-24 23:27 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\

2013-11-22 22:17 - 2013-11-29 22:45 - 00000000 ____D C:\POWER

2013-11-21 07:44 - 2013-11-21 07:44 - 00000000 ____D C:\Users\Max\AppData\Roaming\GalileoPress

2013-11-10 23:53 - 2013-11-10 23:53 - 00319488 ____N (Microsoft Corporation) C:\Windows\Setup1.exe

2013-11-10 23:53 - 2013-11-10 23:53 - 00074752 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE
 

==================== One Month Modified Files and Folders =======
 

2013-12-02 10:03 - 2013-12-02 10:03 - 00000000 ____D C:\FRST

2013-12-02 09:52 - 2013-05-03 08:52 - 00460382 _____ C:\Windows\WindowsUpdate.log

2013-12-02 09:52 - 2009-07-14 05:34 - 00027248 ____H C:\Windows\system32\429CB427-DD9E-4B8E-832D-01C8E5EFA959-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-12-02 09:52 - 2009-07-14 05:34 - 00027248 ____H C:\Windows\system32\429CB427-DD9E-4B8E-832D-01C8E5EFA959-5P-0.4E775122-5005-4884-852F-8747DF615CFD

2013-12-02 08:46 - 2013-12-02 08:46 - 00000032 _____ C:\Windows\Menu.INI

2013-12-02 07:45 - 2010-11-20 22:01 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI

2013-12-02 07:42 - 2009-07-14 05:39 - 00029607 _____ C:\Windows\setupact.log

2013-12-01 23:13 - 2013-05-06 17:41 - 00000000 ____D C:\Users\Max\Documents\AVerTV

2013-12-01 00:13 - 2013-11-30 22:12 - 00000000 ____D C:\BRENN ES

2013-11-30 22:16 - 2013-09-03 20:30 - 00000000 ____D C:\POWERPOINT DATEIEN       230 MB

2013-11-23 08:26 - 2013-08-08 10:17 - 502145914 _____ C:\Windows\MEMORY.DMP

2013-11-23 08:26 - 2013-06-13 06:05 - 00000000 ____D C:\Windows\Minidump

2013-11-23 08:26 - 2013-05-03 23:33 - 00000000 ____D C:\ProgramData\NVIDIA

2013-11-23 08:26 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-23 08:26 - 2009-07-14 05:33 - 00371904 _____ C:\Windows\system32\FNTCACHE.DAT

2013-11-23 08:25 - 2010-11-20 22:48 - 00014420 _____ C:\Windows\PFRO.log

2013-11-21 07:44 - 2013-11-21 07:44 - 00000000 ____D C:\Users\Max\AppData\Roaming\GalileoPress

2013-11-16 09:51 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\spool

2013-11-16 09:50 - 2013-09-14 23:02 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Foxit Software

2013-11-15 20:23 - 2013-09-21 22:19 - 00000000 ____D C:\Users\Max\AppData\Roaming\picpick

2013-11-14 07:41 - 2013-09-24 11:25 - 00000855 _____ C:\Windows\wininit.ini

2013-11-06 07:47 - 2013-05-15 13:52 - 00000000 ____D C:\Users\Max\AppData\Roaming\Serif

2013-11-02 15:11 - 2013-08-03 22:29 - 00000000 ____D C:\BILDERVERZ

2013-11-02 15:06 - 2013-05-04 17:53 - 00000000 ___HD C:\Program Files\InstallShield Installation Information

2013-11-02 15:05 - 2013-09-10 15:21 - 00000000 ____D C:\Users\Administrator\AppData\Local\Downloaded Installations
 

Files to move or delete:

====================

C:\ProgramData\.3755BB240851403755BB240851409ee9ec.dat
 
 

Some content of TEMP:

====================

C:\Users\Administrator\AppData\Local\Temp\conduitinstaller.exe

C:\Users\Max\AppData\Local\Temp\bassmod.dll
 
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 01-12-2013

Ran by Max at 2013-12-02 10:06:20

Running from C:\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Outpost Security Suite Pro (Disabled - Out of date) {ECEA6BCD-A007-0BC7-D5A5-0254DCBD816E}

AS: Outpost Security Suite Pro (Disabled - Out of date) {578B8A29-863D-0449-EF15-3926A73ACBD3}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Outpost Security Suite Pro (Enabled) {D4D1EAE8-EA68-0A9F-FEFA-AB61226EC615}
 

==================== Installed Programs ======================
 

7-Zip 9.20

ACDSee 32

ACDSee Pro 3 (Version: 3.0.355)

AVerMedia A850 USB TV Tuner 1.0.0.33 (Version: 1.0.0.33)

AVerTV 3D (Version: 6.5)

Delphi 7

Foxit Reader (Version: 6.1.1.1031)

Huffyuv AVI lossless video codec (Remove Only)

ISTool 5.3.0.1 (Version: 5.3.0.1)

Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4427.1015)

Microsoft Office Word MUI (German) 2007 (Version: 15.0.4516.1054)

Microsoft Save as PDF Add-in for 2007 Microsoft Office programs (Version: 12.0.4518.1014)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017)

Mozilla Firefox 24.0 (x86 de) (HKCU Version: 24.0)

NVIDIA 3D Vision Treiber 314.22 (Version: 314.22)

NVIDIA Grafiktreiber 314.22 (Version: 314.22)

NVIDIA Install Application (Version: 2.1002.115.743)

NVIDIA PhysX (Version: 9.12.1031)

NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)

NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1422)

NVIDIA Systemsteuerung 314.22 (Version: 314.22)

NVIDIA Update 1.12.12 (Version: 1.12.12)

NVIDIA Update Components (Version: 1.12.12)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017)

Outpost Security Suite Pro 8.0 (Version: 8.0)

Paint Shop Pro 9 (Version: 9.0.2.0000)

PDF-XChange Lite 2012 (Version: 5.0.270.0)

Serif DrawPlus X5 (Version: 12.0.3.025)

SpeedFan (remove only)

WinMerge 2.14.0 (Version: 2.14.0)

WinPcap 4.1.3 (Version: 4.1.0.2980)
 

==================== Restore Points  =========================
 

Could not list Restore Points. Check WMI.
 
 

==================== Hosts content: ==========================
 

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 
 

==================== Loaded Modules (whitelisted) =============
 

2013-05-04 09:07 - 2013-01-07 23:35 - 02242096 _____ () C:\MyProgs\Thunderbird\mozjs.dll

2013-05-04 09:07 - 2013-01-07 23:35 - 00158256 _____ () C:\MyProgs\Thunderbird\NSLDAP32V60.dll

2013-05-04 09:07 - 2013-01-07 23:35 - 00022576 _____ () C:\MyProgs\Thunderbird\NSLDAPPR32V60.dll

2006-10-26 12:56 - 2006-10-26 12:56 - 00757008 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL

2013-10-19 00:54 - 2013-10-19 00:54 - 03279768 _____ () C:\MyProgs\Firefox\mozjs.dll
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 

Name: STK7700D

Description: STK7700D

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 

Name: Basissystemgerät

Description: Basissystemgerät

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 

Name: Basissystemgerät

Description: Basissystemgerät

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 

Name: Basissystemgerät

Description: Basissystemgerät

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 65%

Total physical RAM: 3071.24 MB

Available physical RAM: 1050.03 MB

Total Pagefile: 6255.51 MB

Available Pagefile: 1595.11 MB

Total Virtual: 2047.88 MB

Available Virtual: 1877.56 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:116.44 GB) (Free:7.54 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: (DATA) (Fixed) (Total:109.6 GB) (Free:0.41 GB) NTFS

Drive f: () (CDROM) (Total:116.44 GB) (Free:7.54 GB) NTFS

Drive h: (Pirates4_Münster_Film) (CDROM) (Total:4.38 GB) (Free:0 GB) UDF

Drive i: () (Removable) (Total:3.77 GB) (Free:3.7 GB) FAT
 

==================== MBR & Partition Table ==================
 

==================== End Of Log ============================

ich hoffe nicht, mein Laptop sendet schon auf Kanal :80 "bin ich schon drin?"