| ikarus2557 | 06.03.2017 09:24 |
Hallo Cosinus,
Anbei die 3 logs mbam+ESET+SecurityCheck Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Protection, 06.03.2017 10:03, SYSTEM, DESKTOP-TUSRUQC, Protection, Malware Protection, Starting,
Protection, 06.03.2017 10:03, SYSTEM, DESKTOP-TUSRUQC, Protection, Malware Protection, Started,
Protection, 06.03.2017 10:03, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Starting,
Protection, 06.03.2017 10:03, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Started,
Update, 06.03.2017 10:05, SYSTEM, DESKTOP-TUSRUQC, Manual, Rootkit Database, 2016.2.8.1, 2017.2.27.1,
Update, 06.03.2017 10:05, SYSTEM, DESKTOP-TUSRUQC, Manual, Remediation Database, 2016.2.12.1, 2017.3.5.1,
Update, 06.03.2017 10:06, SYSTEM, DESKTOP-TUSRUQC, Manual, IP Database, 2016.2.8.1, 2017.3.3.1,
Update, 06.03.2017 10:06, SYSTEM, DESKTOP-TUSRUQC, Manual, Domain Database, 2016.2.16.8, 2017.3.5.3,
Update, 06.03.2017 10:10, SYSTEM, DESKTOP-TUSRUQC, Manual, Malware Database, 2016.2.16.6, 2017.3.6.2,
Protection, 06.03.2017 10:10, SYSTEM, DESKTOP-TUSRUQC, Protection, Refresh, Starting,
Protection, 06.03.2017 10:10, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Stopping,
Protection, 06.03.2017 10:10, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Stopped,
Protection, 06.03.2017 10:10, SYSTEM, DESKTOP-TUSRUQC, Protection, Refresh, Success,
Protection, 06.03.2017 10:10, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Starting,
Protection, 06.03.2017 10:10, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Started,
Scan, 06.03.2017 10:21, SYSTEM, DESKTOP-TUSRUQC, Context, Start: 06.03.2017 10:10, Dauer: 2 Min. 27 Sek., Bedrohungssuchlauf, Abgeschlossen, 0 Malware-Erkennung, 39 Nicht-Malware-Erkennungen,
Protection, 06.03.2017 10:22, SYSTEM, DESKTOP-TUSRUQC, Protection, Malware Protection, Starting,
Protection, 06.03.2017 10:22, SYSTEM, DESKTOP-TUSRUQC, Protection, Malware Protection, Started,
Protection, 06.03.2017 10:22, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Starting,
Protection, 06.03.2017 10:22, SYSTEM, DESKTOP-TUSRUQC, Protection, Malicious Website Protection, Started,
(end)
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=init
# utc_time=2016-09-20 12:59:38
# local_time=2016-09-20 07:59:38 (+0700, SE Asia Standard Time)
# country="Thailand"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 30811
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=updated
# utc_time=2016-09-20 01:13:02
# local_time=2016-09-20 08:13:02 (+0700, SE Asia Standard Time)
# country="Thailand"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# engine=30811
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2016-09-21 05:03:15
# local_time=2016-09-21 12:03:15 (+0700, SE Asia Standard Time)
# country="Thailand"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 63612 28244738 0 0
# scanned=2573198
# found=12
# cleaned=12
# scan_time=57012
sh=5B7820485A53F89CFF971D65CE01A7AAC2E8FBCB ft=0 fh=0000000000000000 vn="Win32/HackTool.Patcher.A potenziell unsichere Anwendung (gelöscht)" ac=C fn="C:\$RECYCLE.BIN\S-1-5-21-465342472-1690862640-1647311925-1001\$RB58SPP\Hawaii Photoreal Vol. 2 - Maui v.0.95\FSX Captain Sim 707.rar"
sh=928A536FBFF196495B90E4BD51B932485B84A099 ft=1 fh=748b6a41a833329e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\Users\MSI_USER\AppData\Local\Temp\DMR\dmr_72.exe"
sh=40F6CA5EF25B7DBD42AE8B4FDA5F98144B1AD360 ft=1 fh=08965c270c124c2f vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung (gelöscht)" ac=C fn="C:\Users\MSI_USER\Downloads\ccsetup519.exe"
sh=FB46431DE4C0672F8659E71460F043A4FADD9C15 ft=1 fh=31614a081caee633 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\Users\MSI_USER\Downloads\Image Resizer - CHIP-Installer.exe"
sh=B7C20CA5F3D03CA0B47FE84EA238FF4F69E5183B ft=1 fh=075c4223825eb116 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung (gelöscht)" ac=C fn="D:\Downloads ex C\ccsetup513.exe"
sh=477546F75761C3FB17630D0F7401BA46B6992A69 ft=1 fh=9e83281c124af5cc vn="Variante von Win32/OpenCandy.A potenziell unsichere Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\Downloads ex C\uTorrent.exe"
sh=5B7820485A53F89CFF971D65CE01A7AAC2E8FBCB ft=0 fh=0000000000000000 vn="Win32/HackTool.Patcher.A potenziell unsichere Anwendung (gelöscht)" ac=C fn="D:\FSX Addon sceneries\Hawaii Photoreal Vol. 2 - Maui v.0.95\FSX Captain Sim 707.rar"
sh=477546F75761C3FB17630D0F7401BA46B6992A69 ft=1 fh=9e83281c124af5cc vn="Variante von Win32/OpenCandy.A potenziell unsichere Anwendung (Gesäubert durch Löschen)" ac=C fn="E:\FSX PC thai new DOWNLOADS bup\uTorrent.exe"
sh=5B7820485A53F89CFF971D65CE01A7AAC2E8FBCB ft=0 fh=0000000000000000 vn="Win32/HackTool.Patcher.A potenziell unsichere Anwendung (gelöscht)" ac=C fn="G:\FSX 485GB\FSX FREEWARE\HAWAII ISLANDS\Hawaii Photoreal Vol. 2 - Maui v.0.95\FSX Captain Sim 707.rar"
sh=5B7820485A53F89CFF971D65CE01A7AAC2E8FBCB ft=0 fh=0000000000000000 vn="Win32/HackTool.Patcher.A potenziell unsichere Anwendung (gelöscht)" ac=C fn="G:\FSX 485GB\FSX PAYWARE\Captain Sim 707-fsx.rar"
sh=5B7820485A53F89CFF971D65CE01A7AAC2E8FBCB ft=0 fh=0000000000000000 vn="Win32/HackTool.Patcher.A potenziell unsichere Anwendung (gelöscht)" ac=C fn="G:\FSX 485GB\FSX PAYWARE\Captain Sim 707.rar"
sh=20B2C31135C2E338EC296C23365A20ACBD5BEA8B ft=0 fh=0000000000000000 vn="Win32/HackTool.Patcher.A potenziell unsichere Anwendung (gelöscht)" ac=C fn="G:\FSX 485GB\FSX PAYWARE\1.Captain_Sim\Captain Sim 707.rar"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=init
# utc_time=2017-02-06 08:00:19
# local_time=2017-02-06 03:00:19 (+0700, SE Asia Standard Time)
# country="Thailand"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 32310
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=updated
# utc_time=2017-02-06 08:02:17
# local_time=2017-02-06 03:02:17 (+0700, SE Asia Standard Time)
# country="Thailand"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# engine=32310
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-02-06 11:24:34
# local_time=2017-02-06 06:24:34 (+0700, SE Asia Standard Time)
# country="Thailand"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 12571 40190817 0 0
# scanned=2243677
# found=4
# cleaned=0
# scan_time=12137
sh=45E4EE7D1CF429DB3E1C02C63C7C39BEA9F9A2D9 ft=1 fh=c1d5e5be4faf5d92 vn="Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-465342472-1690862640-1647311925-1001\$R2O612V.exe"
sh=23073837FDCC6878EB8A2DA2248C745215B35D49 ft=1 fh=2114750c0916edcc vn="Variante von Win32/DownloadGuide.D eventuell unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-465342472-1690862640-1647311925-1001\$RG2IAVJ.exe"
sh=928A536FBFF196495B90E4BD51B932485B84A099 ft=1 fh=748b6a41a833329e vn="Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung" ac=I fn="C:\Users\MSI_USER\AppData\Local\Temp\DMR\dmr_72.exe"
sh=D8049E0C4852BA0442E6E2F1FA68783005676016 ft=1 fh=cf5bda33c71546c6 vn="Variante von Win32/PCCleaners.B eventuell unerwünschte Anwendung" ac=I fn="D:\Downloads ex C\app_German.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=init
# utc_time=2017-02-25 03:38:24
# local_time=2017-02-25 10:38:24 (+0700, SE Asia Standard Time)
# country="Switzerland"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 32524
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=updated
# utc_time=2017-02-25 03:41:19
# local_time=2017-02-25 10:41:19 (+0700, SE Asia Standard Time)
# country="Switzerland"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# engine=32524
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-02-25 07:08:13
# local_time=2017-02-26 02:08:13 (+0700, SE Asia Standard Time)
# country="Switzerland"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 13445 41860236 0 0
# scanned=2305307
# found=2
# cleaned=2
# scan_time=12413
sh=928A536FBFF196495B90E4BD51B932485B84A099 ft=1 fh=748b6a41a833329e vn="Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="C:\Users\MSI_USER\AppData\Local\Temp\DMR\dmr_72.exe"
sh=D8049E0C4852BA0442E6E2F1FA68783005676016 ft=1 fh=cf5bda33c71546c6 vn="Variante von Win32/PCCleaners.B eventuell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="D:\Downloads ex C\app_German.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=init
# utc_time=2017-03-06 03:32:43
# local_time=2017-03-06 10:32:43 (+0700, SE Asia Standard Time)
# country="Switzerland"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 32615
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# end=updated
# utc_time=2017-03-06 03:59:42
# local_time=2017-03-06 10:59:42 (+0700, SE Asia Standard Time)
# country="Switzerland"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=2d02fea33b56154eb330baaf9a021e0b
# engine=32615
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-03-06 07:33:17
# local_time=2017-03-06 02:33:17 (+0700, SE Asia Standard Time)
# country="Switzerland"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 42596140 0 0
# scanned=2290247
# found=4
# cleaned=4
# scan_time=12814
sh=7728DFCF828B25E741FFEFEC5D7B2076974083DB ft=1 fh=5d5c959e964e0c7f vn="Variante von Win32/InstallCore.AFF.gen eventuell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="E:\FileHistory\MSI_USER\DESKTOP-TUSRUQC\Data\C\Users\MSI_USER\Downloads\adobe_flash_player (1) (2017_03_04 06_57_20 UTC).exe"
sh=7728DFCF828B25E741FFEFEC5D7B2076974083DB ft=1 fh=5d5c959e964e0c7f vn="Variante von Win32/InstallCore.AFF.gen eventuell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="E:\FileHistory\MSI_USER\DESKTOP-TUSRUQC\Data\C\Users\MSI_USER\Downloads\adobe_flash_player (2017_03_04 06_57_20 UTC).exe"
sh=33906947BCD4108B3E1E3867BD010D436BF37BA0 ft=1 fh=2c9f1b5d09433735 vn="Variante von Win32/DownloadAdmin.R eventuell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="E:\FileHistory\MSI_USER\DESKTOP-TUSRUQC\Data\C\Users\MSI_USER\Downloads\adobe_flash_player-68612565 (2017_03_04 06_57_20 UTC).exe"
sh=7B6CF9DD005245CB25E7CF9954866E3795197098 ft=1 fh=01a8edf07803f181 vn="Variante von Win32/InstallCore.ADX.gen eventuell unerwünschte Anwendung (Gesäubert durch Löschen)" ac=C fn="E:\FileHistory\MSI_USER\DESKTOP-TUSRUQC\Data\C\Users\MSI_USER\Downloads\FlashVideoPlayer (2017_03_04 06_57_20 UTC).exe"
Code:
Results of screen317's Security Check version 1.009
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 24.0.0.221
Google Chrome (56.0.2924.87)
Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
ESET ESET Online Scanner OnlineScannerApp.exe
ESET ESET Online Scanner OnlineCmdLineScanner.exe
Malwarebytes Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
|
Malwarebytes Anti-Malware 
SecurityCheck und: