| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Sirefef.A.78 & TR/Crypt.XPACK.GenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
24.05.2013, 11:03
| #1 |
| /// Malwareteam / Visitor  |  TR/Sirefef.A.78 & TR/Crypt.XPACK.Gen Anscheinend fehlen einige Dateien ;( Systemscan mit ZOEK Bitte lade die zoek.exe von hier: http://hijackthis.nl/smeenk/
|
|
24.05.2013, 11:33
| #2 |
 | TR/Sirefef.A.78 & TR/Crypt.XPACK.GenCode:
ATTFilter Zoek.exe Version 4.0.0.2 Updated 23-May-2013
Tool run by Domi on 24.05.2013 at 12:15:43,99.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
==== Older Logs ======================
C:\zoek-results23.05.2013-2015.log 15030 bytes
==== Folders Found ======================
==== Files Found ======================
--- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_de-de_6f990fba53ab4391\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 11776
Created time: 2011-08-29 18:52:22
Modified time: 2010-11-20 12:01:26
MD5: EE272712CE7A3F2B9C1B9F9AFCE91D52
SHA1: 0063534206F6E04BE2AA40E7DD7FB47CB64AC009
--- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_en-us_1889e5b342894f56\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 11264
Created time: 2011-08-29 18:52:30
Modified time: 2010-11-20 12:10:18
MD5: 3CC8F0B0BF25A8A9AF1B3C6863A74ACC
SHA1: F33A2FD8400B8B46155F4AA5747DDBD479146F33
--- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.5.7601.17514_none_c315782c0def9f8f\wuaueng.dll ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll
File type: ----a-w-
File size: 1914368
Created time: 2011-08-29 18:53:37
Modified time: 2010-11-20 12:21:40
MD5: 3026418A50C5B4761BEFA632CEDB7406
SHA1: 0E3CB015DB94C7B43371771FBA516A6F6EC6A17A
--- C:\Windows\System32\de-DE\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 18456
Created time: 2012-06-19 06:42:06
Modified time: 2012-06-02 22:19:37
MD5: DF9B0AFCE497E30F6F34D8FCAF4798EB
SHA1: DADF923DD51F69BA690966C3B177AB3EC10EA904
--- C:\Windows\winsxs\Backup\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.6.7600.256_de-de_265a0ffcdeef2542_wuaueng.dll.mui_297f975d ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 18456
Created time: 2012-06-19 06:42:55
Modified time: 2012-06-19 06:42:51
MD5: DF9B0AFCE497E30F6F34D8FCAF4798EB
SHA1: DADF923DD51F69BA690966C3B177AB3EC10EA904
--- C:\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_579306edb982ae36\MpSvc.dll ---
Company: Microsoft Corporation
File Description: Service Module
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: MpSvc.dll
File type: ------w-
File size: 680960
Created time: 2009-07-13 23:37:40
Modified time: 2009-07-14 01:15:41
MD5: 3FAE8F94296001C32EAB62CD7D82E0FD
SHA1: C4B886D911AAB8EE1FED3ACD2478C5F15D7C5B87
--- C:\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_59c41ab5b67131d0\MpSvc.dll ---
Company: Microsoft Corporation
File Description: Service Module
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: MpSvc.dll
File type: ------w-
File size: 680960
Created time: 2009-07-13 23:37:40
Modified time: 2009-07-14 01:15:41
MD5: 3FAE8F94296001C32EAB62CD7D82E0FD
SHA1: C4B886D911AAB8EE1FED3ACD2478C5F15D7C5B87
--- C:\Windows\System32\de-DE\ipnathlp.dll.mui ---
Company: Microsoft Corporation
File Description: Microsoft NAT-Hilfskomponenten
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: IPNATHLP.DLL.MUI
File type: ----a-w-
File size: 20480
Created time: 2010-06-18 19:51:28
Modified time: 2010-06-18 19:51:28
MD5: AD2C0A08FBBC80345849BFC3AAABD63F
SHA1: 965CF173A6BE589493DBCB2C4AC0BC133855D6A5
--- C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\ipnathlp.dll.mui ---
Company: Microsoft Corporation
File Description: Microsoft NAT-Hilfskomponenten
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: IPNATHLP.DLL.MUI
File type: ----a-w-
File size: 20480
Created time: 2010-06-18 19:51:28
Modified time: 2010-06-18 19:51:28
MD5: AD2C0A08FBBC80345849BFC3AAABD63F
SHA1: 965CF173A6BE589493DBCB2C4AC0BC133855D6A5
--- C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\ipnathlp.dll.mui ---
Company: Microsoft Corporation
File Description: Microsoft NAT Helper Components
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: IPNATHLP.DLL.MUI
File type: ----a-w-
File size: 17920
Created time: 2009-07-14 04:55:04
Modified time: 2009-07-14 02:06:42
MD5: B3442B30D0BDC62438C4DAE70841E483
SHA1: F87E26D9E19B4CA57E4A290BD9A28911B06C530F
--- C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_04a3b4c9aa9fddd8\ipnathlp.dll ---
Company: Microsoft Corporation
File Description: Microsoft NAT Helper Components
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: IPNATHLP.DLL
File type: ------w-
File size: 300544
Created time: 2009-07-13 23:54:28
Modified time: 2009-07-14 01:15:33
MD5: D1A079A0DE2EA524513B6930C24527A2
SHA1: FA735F2C99B767224E7EC0686768E412D362A15C
==== EOF on 24.05.2013 at 12:20:33,74 ======================
|
|
24.05.2013, 11:59
| #3 |
| /// Malwareteam / Visitor | TR/Sirefef.A.78 & TR/Crypt.XPACK.Gen
Scan mit Combofix
|
|
24.05.2013, 12:42
| #4 |
| | TR/Sirefef.A.78 & TR/Crypt.XPACK.GenCode:
ATTFilter Zoek.exe Version 4.0.0.2 Updated 23-May-2013
Tool run by Domi on 24.05.2013 at 13:17:42,81.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
==== Older Logs ======================
C:\zoek-results23.05.2013-2015.log 15030 bytes
C:\zoek-results24.05.2013-1220.log 7248 bytes
==== Batch Command(s) Run By Tool======================
==== Folders Found ======================
==== Files Found ======================
--- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_de-de_6f990fba53ab4391\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 11776
Created time: 2011-08-29 18:52:22
Modified time: 2010-11-20 12:01:26
MD5: EE272712CE7A3F2B9C1B9F9AFCE91D52
SHA1: 0063534206F6E04BE2AA40E7DD7FB47CB64AC009
--- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_en-us_1889e5b342894f56\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 11264
Created time: 2011-08-29 18:52:30
Modified time: 2010-11-20 12:10:18
MD5: 3CC8F0B0BF25A8A9AF1B3C6863A74ACC
SHA1: F33A2FD8400B8B46155F4AA5747DDBD479146F33
--- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.5.7601.17514_none_c315782c0def9f8f\wuaueng.dll ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll
File type: ----a-w-
File size: 1914368
Created time: 2011-08-29 18:53:37
Modified time: 2010-11-20 12:21:40
MD5: 3026418A50C5B4761BEFA632CEDB7406
SHA1: 0E3CB015DB94C7B43371771FBA516A6F6EC6A17A
--- C:\Windows\System32\wuaueng.dll ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll
File type: ----a-w-
File size: 1914368
Created time: 2013-05-24 11:18:25
Modified time: 2010-11-20 12:21:40
MD5: 3026418A50C5B4761BEFA632CEDB7406
SHA1: 0E3CB015DB94C7B43371771FBA516A6F6EC6A17A
--- C:\Windows\System32\de-DE\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 18456
Created time: 2012-06-19 06:42:06
Modified time: 2012-06-02 22:19:37
MD5: DF9B0AFCE497E30F6F34D8FCAF4798EB
SHA1: DADF923DD51F69BA690966C3B177AB3EC10EA904
--- C:\Windows\winsxs\Backup\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.6.7600.256_de-de_265a0ffcdeef2542_wuaueng.dll.mui_297f975d ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 18456
Created time: 2012-06-19 06:42:55
Modified time: 2012-06-19 06:42:51
MD5: DF9B0AFCE497E30F6F34D8FCAF4798EB
SHA1: DADF923DD51F69BA690966C3B177AB3EC10EA904
--- C:\Windows\winsxs\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.3.7600.16385_de-de_dd0a616919260db5\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.3.7600.16385 (win7_rtm.090713-1255)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 11776
Created time: 2010-06-18 19:51:23
Modified time: 2010-06-18 19:51:23
MD5: FBA2007CBBAA05B2ED5129C94D46737A
SHA1: 8E6D582603966E24ECCF241118C232EA39345F44
--- C:\Windows\winsxs\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_de-de_6f990fba53ab4391\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 11776
Created time: 2013-05-24 06:32:50
Modified time: 2010-11-20 02:01:28
MD5: EE272712CE7A3F2B9C1B9F9AFCE91D52
SHA1: 0063534206F6E04BE2AA40E7DD7FB47CB64AC009
--- C:\Windows\winsxs\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.5.7601.17514_en-us_1889e5b342894f56\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 11264
Created time: 2013-05-24 06:25:31
Modified time: 2010-11-20 02:10:20
MD5: 3CC8F0B0BF25A8A9AF1B3C6863A74ACC
SHA1: F33A2FD8400B8B46155F4AA5747DDBD479146F33
--- C:\Windows\winsxs\x86_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_7.6.7600.256_de-de_265a0ffcdeef2542\wuaueng.dll.mui ---
Company: Microsoft Corporation
File Description: Windows Update-Agent
File Version: 7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: wuaueng.dll.mui
File type: ----a-w-
File size: 18456
Created time: 2012-06-19 06:42:06
Modified time: 2012-06-02 22:19:37
MD5: DF9B0AFCE497E30F6F34D8FCAF4798EB
SHA1: DADF923DD51F69BA690966C3B177AB3EC10EA904
--- C:\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.3.7600.16385_none_3086c9dad36a69b3\wuaueng.dll ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.3.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll
File type: ----a-w-
File size: 1912832
Created time: 2009-07-14 00:15:32
Modified time: 2009-07-14 01:16:21
MD5: A33408CC036F9C08142B11BE5E93F0A1
SHA1: 81550E3722478783B1EC2BBD20F33220AA39855A
--- C:\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.5.7601.17514_none_c315782c0def9f8f\wuaueng.dll ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll
File type: ----a-w-
File size: 1914368
Created time: 2013-05-24 06:20:36
Modified time: 2010-11-20 02:21:42
MD5: 3026418A50C5B4761BEFA632CEDB7406
SHA1: 0E3CB015DB94C7B43371771FBA516A6F6EC6A17A
--- C:\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.6.7600.256_none_79d6786e99338140\wuaueng.dll ---
Company: Microsoft Corporation
File Description: Windows Update Agent
File Version: 7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: wuaueng.dll
File type: ------w-
File size: 1933848
Created time: 2012-06-19 06:42:07
Modified time: 2012-06-02 22:19:17
MD5: FC3EC24FCE372C89423E015A2AC1A31E
SHA1: 12A8E93523C7F22889A3F8418897C57BFC02046A
--- C:\Program Files\Windows Defender\MpSvc.dll ---
Company: Microsoft Corporation
File Description: Service Module
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: MpSvc.dll
File type: ----a-w-
File size: 680960
Created time: 2013-05-24 11:18:25
Modified time: 2009-07-14 01:15:41
MD5: 3FAE8F94296001C32EAB62CD7D82E0FD
SHA1: C4B886D911AAB8EE1FED3ACD2478C5F15D7C5B87
--- C:\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_579306edb982ae36\MpSvc.dll ---
Company: Microsoft Corporation
File Description: Service Module
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: MpSvc.dll
File type: ------w-
File size: 680960
Created time: 2009-07-13 23:37:40
Modified time: 2009-07-14 01:15:41
MD5: 3FAE8F94296001C32EAB62CD7D82E0FD
SHA1: C4B886D911AAB8EE1FED3ACD2478C5F15D7C5B87
--- C:\Windows\winsxs\x86_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_59c41ab5b67131d0\MpSvc.dll ---
Company: Microsoft Corporation
File Description: Service Module
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: MpSvc.dll
File type: ------w-
File size: 680960
Created time: 2009-07-13 23:37:40
Modified time: 2009-07-14 01:15:41
MD5: 3FAE8F94296001C32EAB62CD7D82E0FD
SHA1: C4B886D911AAB8EE1FED3ACD2478C5F15D7C5B87
--- C:\Windows\System32\ipnathlp.dll ---
Company: Microsoft Corporation
File Description: Microsoft NAT-Hilfskomponenten
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: IPNATHLP.DLL.MUI
File type: ----a-w-
File size: 300544
Created time: 2013-05-24 11:18:25
Modified time: 2009-07-14 01:15:33
MD5: D1A079A0DE2EA524513B6930C24527A2
SHA1: FA735F2C99B767224E7EC0686768E412D362A15C
--- C:\Windows\System32\de-DE\ipnathlp.dll.mui ---
Company: Microsoft Corporation
File Description: Microsoft NAT-Hilfskomponenten
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: IPNATHLP.DLL.MUI
File type: ----a-w-
File size: 20480
Created time: 2010-06-18 19:51:28
Modified time: 2010-06-18 19:51:28
MD5: AD2C0A08FBBC80345849BFC3AAABD63F
SHA1: 965CF173A6BE589493DBCB2C4AC0BC133855D6A5
--- C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\ipnathlp.dll.mui ---
Company: Microsoft Corporation
File Description: Microsoft NAT-Hilfskomponenten
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Betriebssystem Microsoft® Windows®
Copyright: © Microsoft Corporation. Alle Rechte vorbehalten.
Original Filename: IPNATHLP.DLL.MUI
File type: ----a-w-
File size: 20480
Created time: 2010-06-18 19:51:28
Modified time: 2010-06-18 19:51:28
MD5: AD2C0A08FBBC80345849BFC3AAABD63F
SHA1: 965CF173A6BE589493DBCB2C4AC0BC133855D6A5
--- C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\ipnathlp.dll.mui ---
Company: Microsoft Corporation
File Description: Microsoft NAT Helper Components
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: IPNATHLP.DLL.MUI
File type: ----a-w-
File size: 17920
Created time: 2009-07-14 04:55:04
Modified time: 2009-07-14 02:06:42
MD5: B3442B30D0BDC62438C4DAE70841E483
SHA1: F87E26D9E19B4CA57E4A290BD9A28911B06C530F
--- C:\Windows\winsxs\x86_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_04a3b4c9aa9fddd8\ipnathlp.dll ---
Company: Microsoft Corporation
File Description: Microsoft NAT Helper Components
File Version: 6.1.7600.16385 (win7_rtm.090713-1255)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: IPNATHLP.DLL
File type: ------w-
File size: 300544
Created time: 2009-07-13 23:54:28
Modified time: 2009-07-14 01:15:33
MD5: D1A079A0DE2EA524513B6930C24527A2
SHA1: FA735F2C99B767224E7EC0686768E412D362A15C
==== EOF on 24.05.2013 at 13:19:39,03 ======================
Code:
ATTFilter ComboFix 13-05-24.01 - Domi 24.05.2013 13:24:54.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2909.1365 [GMT 2:00]
ausgeführt von:: c:\users\Domi\Downloads\ComboFix\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AntiMalware
c:\program files\AntiMalware\2\adwcleaner.exe
c:\program files\AntiMalware\2\mbar-1.05.0.1001.zip
c:\program files\AntiMalware\2\mbar\Data\actions.ref
c:\program files\AntiMalware\2\mbar\Data\Configuration\build.conf
c:\program files\AntiMalware\2\mbar\Data\Configuration\config.conf
c:\program files\AntiMalware\2\mbar\Data\Configuration\database.conf
c:\program files\AntiMalware\2\mbar\Data\Configuration\local.conf
c:\program files\AntiMalware\2\mbar\Data\Configuration\manifest.conf
c:\program files\AntiMalware\2\mbar\Data\rules.ref
c:\program files\AntiMalware\2\mbar\Data\swissarmy.ref
c:\program files\AntiMalware\2\mbar\imageformats\qico4.dll
c:\program files\AntiMalware\2\mbar\imageformats\qicod4.dll
c:\program files\AntiMalware\2\mbar\Languages\English.lng
c:\program files\AntiMalware\2\mbar\License.rtf
c:\program files\AntiMalware\2\mbar\mbam.dll
c:\program files\AntiMalware\2\mbar\mbamcore.dll
c:\program files\AntiMalware\2\mbar\mbamnet.dll
c:\program files\AntiMalware\2\mbar\mbar-log-2013-05-23 (21-17-28).txt
c:\program files\AntiMalware\2\mbar\mbar.exe
c:\program files\AntiMalware\2\mbar\msvcp100.dll
c:\program files\AntiMalware\2\mbar\msvcr100.dll
c:\program files\AntiMalware\2\mbar\Plugins\fixdamage.exe
c:\program files\AntiMalware\2\mbar\QtCore4.dll
c:\program files\AntiMalware\2\mbar\QtGui4.dll
c:\program files\AntiMalware\2\mbar\ReadMe.rtf
c:\program files\AntiMalware\2\mbar\system-log.txt
c:\program files\AntiMalware\mbam-setup-1.75.0.1300.exe
c:\program files\AntiMalware\tdsskiller.exe
c:\program files\AntiMalware\zoek.exe
c:\program files\c
c:\program files\c\devcpp-4.9.9.2_setup_uni.exe
c:\program files\c\vcPlus_web.exe
c:\program files\c\vcPlus_web.exe.part
c:\program files\msoffice
c:\program files\msoffice\AUTORUN.INF
c:\program files\msoffice\CDLAUNCH\SHELEXEC.EXE
c:\program files\msoffice\FULLFILE\BCM2007SP1-KB941652-fullfile-enu.exe
c:\program files\msoffice\FULLFILE\office2007-kb946691-fullfile-x86-glb.exe
c:\program files\msoffice\FULLFILE\Office2007SP1-kb936982-fullfile-en-us.exe
c:\program files\msoffice\FULLFILE\Project2007SP1-kb937154-fullfile-en-us.exe
c:\program files\msoffice\FULLFILE\SharePointDesigner2007SP1-kb937162-fullfile-en-us.exe
c:\program files\msoffice\FULLFILE\Visio2007SP1-kb937155-fullfile-en-us.exe
c:\program files\msoffice\SP1INST.HTM
C:\programfiles
c:\users\Domi\4.0
c:\users\Domi\AppData\Roaming\explorateur
c:\users\Domi\AppData\Roaming\explorateur\ICSharpCode.SharpZipLib.dll
c:\users\Domi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum
c:\windows\s.bat
c:\windows\system32\TPAPSLOG.LOG
c:\windows\system32\TPHDLOG0.LOG
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-04-24 bis 2013-05-24 ))))))))))))))))))))))))))))))
.
.
2013-05-24 11:33 . 2013-05-24 11:33 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-24 11:18 . 2010-11-20 12:21 1914368 ----a-w- c:\windows\system32\wuaueng.dll
2013-05-24 11:18 . 2009-07-14 01:15 680960 ----a-w- c:\program files\Windows Defender\MpSvc.dll
2013-05-24 11:18 . 2009-07-14 01:15 300544 ----a-w- c:\windows\system32\ipnathlp.dll
2013-05-24 06:53 . 2013-05-24 06:53 -------- d-----w- c:\windows\system32\SPReview
2013-05-24 06:21 . 2010-11-20 02:19 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2013-05-24 06:20 . 2010-11-20 02:21 72192 ----a-w- c:\windows\system32\regapi.dll
2013-05-24 06:13 . 2013-05-24 06:13 -------- d-----w- c:\windows\system32\EventProviders
2013-05-23 18:13 . 2013-05-24 11:33 -------- d-----w- c:\users\Domi\AppData\Local\Temp
2013-05-23 06:36 . 2013-05-23 06:36 -------- d-----w- c:\users\Domi\AppData\Roaming\Malwarebytes
2013-05-23 06:36 . 2013-05-23 06:36 -------- d-----w- c:\programdata\Malwarebytes
2013-05-23 06:36 . 2013-05-23 06:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-23 06:36 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-23 06:35 . 2013-05-23 06:35 -------- d-----w- c:\users\Domi\AppData\Local\Programs
2013-05-11 10:37 . 2013-05-11 10:37 209472 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2013-05-08 16:36 . 2013-05-08 16:35 66656 ----a-w- c:\windows\system32\drivers\avnetflt.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-24 06:46 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2013-05-15 06:06 . 2012-12-19 17:21 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 06:06 . 2011-05-27 10:06 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-30 07:45 . 2013-02-26 11:55 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-03-30 07:45 . 2013-02-26 11:55 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-03-30 07:45 . 2013-02-26 11:55 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\Domi\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\Domi\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\Domi\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\Domi\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\Domi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-12-10 1199576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-03 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-03 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-03 166936]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2009-10-09 487992]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-14 1549608]
"TpShocks"="c:\windows\system32\TpShocks.exe" [2009-09-02 186208]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-09-29 4114288]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-09-29 5064560]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-05-08 345312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WLStart"="c:\program files\Windows Live\Installer\wlstart.exe" [2009-07-26 786760]
.
c:\users\Domi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Domi\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-3-12 29106336]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2009-7-1 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 01:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 10:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartAudio]
2009-07-16 20:38 307768 ------w- c:\program files\CONEXANT\SAII\SAIICpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock.sys [x]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [x]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [x]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 funfrm;funfrm; [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]
S2 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [x]
S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
S3 acpials;ALS-Sensorfilter;c:\windows\system32\DRIVERS\acpials.sys [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [x]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [x]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-19 06:06]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-13 21:22]
.
2013-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-13 21:22]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://lenovo.msn.com
uInternet Settings,ProxyOverride = *.local
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Domi\AppData\Roaming\Mozilla\Firefox\Profiles\c3c4147w.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
FF - prefs.js: network.proxy.ftp - 87.98.226.33
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - 87.98.226.33
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 87.98.226.33
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 87.98.226.33
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-Cisco AnyConnect Secure Mobility Agent for Windows - c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
MSConfigStartUp-VeriFaceManager - c:\program files\Lenovo\VeriFace\PManage.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-05-24 13:36:32
ComboFix-quarantined-files.txt 2013-05-24 11:36
.
Vor Suchlauf: 7 Verzeichnis(se), 184.764.936.192 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 184.425.205.760 Bytes frei
.
- - End Of File - - 168B093BB38581D8847E73B6220FC760
|
|
| Themen zu TR/Sirefef.A.78 & TR/Crypt.XPACK.Gen |
| administrator, autostart, e-banking, explorer, fehlermeldung, gelöscht, hijack.trojan.siredef.c, log, malwarebytes, microsoft, neuaufsetzung, pum.disabled.securitycenter, recycle.bin, sicherheit, software, temp, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/sirefef.a., tr/sirefef.a.7, trojan.0access, trojan.zaccess, trojan.zbot.ed |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
