| |
| |||||||
Log-Analyse und Auswertung: Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.06.2013, 15:29
| #9 |
 |  Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) hat etwas länger gedauert, da sind einige tmp am Rechner. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=915aeec538fe0b40a1f45af8f597dcc0
# engine=14197
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-29 02:12:21
# local_time=2013-06-29 04:12:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 25715881 124144991 0 0
# scanned=243078
# found=4
# cleaned=0
# scan_time=12004
sh=F7953191F2E616F307C9EDDEF5E78B388FBBAD59 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Christian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\277f5fae-35d7b332"
sh=0E7DA3207341FEE532B78B44BEDF530ADEED05E3 ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\Familie Achleitner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0QQIRCYE\thebobiporn_com[1].htm"
sh=2D7E1CBA04DFEB605DC522357FD92E5E6586DC1A ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\Familie Achleitner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8CQPWPIY\thebobiporn_com[1].htm"
sh=510CA1D9F767AA603A32943875290AED4D535BB3 ft=1 fh=4dc253c6253d1699 vn="Win32/LockScreen.AQD trojan" ac=I fn="C:\_OTL\MovedFiles\06292013_091919\C_Users\Christian\AppData\Roaming\skype.dat"
SecurityCheck konnte nur im Kompatibilitätsmodus ausgeführt werden. Code:
ATTFilter Results of screen317's Security Check version 0.99.68
Windows XP x64 (UAC is enabled)
Out of date service pack!!
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 31
Java version out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader 10.1.6 Adobe Reader out of Date!
Mozilla Firefox 4.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2013 01
Ran by Christian (administrator) on 29-06-2013 16:25:24
Running from C:\Users\Christian\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgemc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(Pokki) C:\Users\Christian\AppData\Local\Pokki\Engine\pokki.exe
(PortableApps.com) E:\PortableApps\GoogleChromePortable\GoogleChromePortable.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Google Inc.) E:\PortableApps\GoogleChromePortable\App\Chrome-bin\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKCU\...\Run: [Sony PC Companion] "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background [449248 2013-05-29] (Sony)
HKCU\...\Run: [KingTranslate] "C:\Program Files (x86)\KingTranslate\KingTranslate.exe" /NotShowMainWindow [164352 2013-02-04] (KoyoteSoft Inc.)
HKCU\...\Run: [Pokki] C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\LaunchDeskband.dll",RunLaunchDeskband [x]
HKCU\...\Winlogon: [Shell] explorer.exe, <==== ATTENTION
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: {6514dba2-473d-11e1-b502-90fba66bfc0a} - E:\Startme.exe
HKLM-x32\...\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe [2077536 2012-01-26] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [2255184 2013-05-15] (LogMeIn Inc.)
HKU\Familie Achleitner\...\Run: [Google Update] "C:\Users\Familie Achleitner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-03-02] (Google Inc.)
HKU\Familie Achleitner\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
AppInit_DLLs: avgrssta.dll [13048 2010-09-03] (AVG Technologies CZ, s.r.o.)
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk
ShortcutTarget: Game Alarm.lnk -> C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.)
Startup: C:\Users\Familie Achleitner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=hp&installDate=12/04/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AT&userid=e2071b6c-b3d5-4370-879c-44d7e8e11cc5&searchtype=ds&q={searchTerms}&installDate=12/04/2013
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
Tcpip\Parameters: [DhcpNameServer] 213.153.32.129 213.153.32.1 192.168.1.1
==================== Services (Whitelisted) =================
R2 avg9emc; C:\Program Files (x86)\AVG\AVG9\avgemc.exe [921952 2010-09-03] (AVG Technologies CZ, s.r.o.)
R2 avg9wd; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [308136 2010-09-03] (AVG Technologies CZ, s.r.o.)
==================== Drivers (Whitelisted) ====================
R1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [282976 2013-01-15] (AVG Technologies CZ, s.r.o.)
R1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2011-09-12] (AVG Technologies CZ, s.r.o.)
R1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2011-05-06] (AVG Technologies CZ, s.r.o.)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
S3 FXDrv32; \??\D:\FXDrv64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-29 16:25 - 2013-06-29 16:25 - 01933592 ____A (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2013-06-29 16:18 - 2013-06-29 16:18 - 00890988 ____A C:\Users\Christian\Desktop\SecurityCheck.exe
2013-06-29 12:50 - 2013-06-29 12:50 - 02347384 ____A (ESET) C:\Users\Christian\Desktop\esetsmartinstaller_enu.exe
2013-06-29 10:57 - 2013-06-29 10:57 - 00011064 ____A C:\Users\Christian\Desktop\Addition.txt
2013-06-29 10:53 - 2013-06-29 10:53 - 00000000 ____D C:\FRST
2013-06-29 10:48 - 2013-06-29 10:48 - 00001761 ____A C:\Users\Christian\Desktop\JRT.txt
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\JRT
2013-06-29 10:40 - 2013-06-29 10:40 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Christian\Desktop\JRT.exe
2013-06-29 10:32 - 2013-06-29 10:33 - 00021220 ____A C:\AdwCleaner[S1].txt
2013-06-29 10:32 - 2013-06-29 10:32 - 00022768 ____A C:\AdwCleaner[R1].txt
2013-06-29 10:31 - 2013-06-29 10:31 - 00648201 ____A C:\Users\Christian\Desktop\adwcleaner.exe
2013-06-29 09:19 - 2013-06-29 09:19 - 00000000 ____D C:\_OTL
2013-06-29 08:41 - 2013-06-29 08:41 - 00061838 ____A C:\Users\Familie Achleitner\Desktop\Extras.Txt
2013-06-29 08:39 - 2013-06-29 08:39 - 00099550 ____A C:\Users\Familie Achleitner\Desktop\OTL.Txt
2013-06-29 08:23 - 2013-06-29 08:23 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\OTL.exe
2013-06-29 08:21 - 2013-06-29 08:21 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Downloads\7478.tmp
2013-06-29 08:18 - 2013-06-29 08:18 - 00000480 ____A C:\Users\Familie Achleitner\Desktop\defogger_disable.log
2013-06-29 08:18 - 2013-06-29 08:18 - 00000000 ____A C:\Users\Christian\defogger_reenable
2013-06-29 08:17 - 2013-05-14 14:22 - 00377856 ____A C:\Users\Familie Achleitner\Desktop\3-gmer_2.1.19163.exe
2013-06-29 08:17 - 2013-05-14 14:21 - 00050477 ____A C:\Users\Familie Achleitner\Desktop\1-Defogger.exe
2013-06-29 08:17 - 2013-05-14 14:00 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\2-OTL.exe
2013-06-29 08:00 - 2013-06-29 08:00 - 00002315 ____A C:\Users\Christian\Desktop\Search.lnk
2013-06-27 21:06 - 2013-06-27 21:06 - 00002026 ____A C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-06-16 03:01 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-16 03:01 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-16 03:01 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-16 03:01 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-16 03:01 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-16 03:01 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-16 03:01 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 03:05 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-14 03:05 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-14 03:05 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 03:05 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 03:05 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 03:05 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 03:05 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-14 03:05 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-13 12:12 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 12:12 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 12:11 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 12:11 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 12:11 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 12:11 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 12:11 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 12:11 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 12:11 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 12:11 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 12:11 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 12:11 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-13 12:11 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-13 12:11 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-13 12:11 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-02 12:59 - 2013-06-02 12:59 - 00903072 ____A (Oracle Corporation) C:\Users\Familie Achleitner\Downloads\jxpiinstall.exe
2013-05-30 22:13 - 2013-05-30 22:13 - 00282960 ____A C:\Windows\Minidump\053013-39686-01.dmp
==================== One Month Modified Files and Folders =======
2013-06-29 16:25 - 2013-06-29 16:25 - 01933592 ____A (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2013-06-29 16:22 - 2011-03-02 18:05 - 00001172 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003UA.job
2013-06-29 16:18 - 2013-06-29 16:18 - 00890988 ____A C:\Users\Christian\Desktop\SecurityCheck.exe
2013-06-29 16:08 - 2010-09-03 15:41 - 02018415 ____A C:\Windows\WindowsUpdate.log
2013-06-29 16:00 - 2012-11-23 16:56 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 12:50 - 2013-06-29 12:50 - 02347384 ____A (ESET) C:\Users\Christian\Desktop\esetsmartinstaller_enu.exe
2013-06-29 10:57 - 2013-06-29 10:57 - 00011064 ____A C:\Users\Christian\Desktop\Addition.txt
2013-06-29 10:53 - 2013-06-29 10:53 - 00000000 ____D C:\FRST
2013-06-29 10:48 - 2013-06-29 10:48 - 00001761 ____A C:\Users\Christian\Desktop\JRT.txt
2013-06-29 10:47 - 2013-04-26 19:06 - 00000000 ____D C:\Users\Christian\AppData\Local\Pokki
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\Windows\ERUNT
2013-06-29 10:45 - 2013-06-29 10:45 - 00000000 ____D C:\JRT
2013-06-29 10:43 - 2009-07-14 06:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:43 - 2009-07-14 06:45 - 00013632 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-29 10:40 - 2013-06-29 10:40 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Christian\Desktop\JRT.exe
2013-06-29 10:36 - 2012-09-20 11:10 - 00000000 ____D C:\Users\Christian\AppData\Local\LogMeIn Hamachi
2013-06-29 10:34 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-29 10:34 - 2009-07-14 06:51 - 00124414 ____A C:\Windows\setupact.log
2013-06-29 10:33 - 2013-06-29 10:32 - 00021220 ____A C:\AdwCleaner[S1].txt
2013-06-29 10:32 - 2013-06-29 10:32 - 00022768 ____A C:\AdwCleaner[R1].txt
2013-06-29 10:31 - 2013-06-29 10:31 - 00648201 ____A C:\Users\Christian\Desktop\adwcleaner.exe
2013-06-29 09:30 - 2012-09-13 19:42 - 00000000 ____D C:\Users\Familie Achleitner\AppData\Local\LogMeIn Hamachi
2013-06-29 09:29 - 2011-12-20 14:11 - 00000000 ____D C:\Program Files\Google
2013-06-29 09:29 - 2011-12-20 14:10 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-29 09:29 - 2010-09-14 11:20 - 00067308 ____A C:\Windows\PFRO.log
2013-06-29 09:19 - 2013-06-29 09:19 - 00000000 ____D C:\_OTL
2013-06-29 09:14 - 2011-12-20 14:10 - 00000000 ____D C:\Users\Christian\AppData\Local\Google
2013-06-29 09:14 - 2011-12-20 14:10 - 00000000 ____D C:\ProgramData\Google
2013-06-29 09:14 - 2011-03-02 18:05 - 00000000 ____D C:\Users\Familie Achleitner\AppData\Local\Google
2013-06-29 08:41 - 2013-06-29 08:41 - 00061838 ____A C:\Users\Familie Achleitner\Desktop\Extras.Txt
2013-06-29 08:39 - 2013-06-29 08:39 - 00099550 ____A C:\Users\Familie Achleitner\Desktop\OTL.Txt
2013-06-29 08:23 - 2013-06-29 08:23 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Desktop\OTL.exe
2013-06-29 08:21 - 2013-06-29 08:21 - 00602112 ____A (OldTimer Tools) C:\Users\Familie Achleitner\Downloads\7478.tmp
2013-06-29 08:18 - 2013-06-29 08:18 - 00000480 ____A C:\Users\Familie Achleitner\Desktop\defogger_disable.log
2013-06-29 08:18 - 2013-06-29 08:18 - 00000000 ____A C:\Users\Christian\defogger_reenable
2013-06-29 08:18 - 2010-09-03 15:41 - 00000000 ____D C:\users\Christian
2013-06-29 08:15 - 2009-07-14 19:58 - 00654150 ____A C:\Windows\System32\perfh007.dat
2013-06-29 08:15 - 2009-07-14 19:58 - 00130022 ____A C:\Windows\System32\perfc007.dat
2013-06-29 08:15 - 2009-07-14 07:13 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-29 08:00 - 2013-06-29 08:00 - 00002315 ____A C:\Users\Christian\Desktop\Search.lnk
2013-06-29 07:47 - 2010-09-03 16:36 - 00000000 ____D C:\Windows\System32\Drivers\Avg
2013-06-27 21:51 - 2009-07-14 07:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 21:06 - 2013-06-27 21:06 - 00002026 ____A C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-06-27 21:06 - 2011-02-17 19:15 - 00388048 ____A C:\Windows\DPINST.LOG
2013-06-27 21:05 - 2011-01-19 15:32 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-27 20:22 - 2011-03-02 18:05 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2981905205-1357387969-867761577-1003Core.job
2013-06-14 04:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-14 03:32 - 2010-09-10 11:18 - 00000000 ____D C:\users\Familie Achleitner
2013-06-14 03:07 - 2010-02-24 12:06 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 12:00 - 2012-11-23 16:56 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-13 12:00 - 2012-11-23 16:56 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-08 16:08 - 2013-06-16 03:01 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-16 03:01 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-16 03:01 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-16 03:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-16 03:01 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-16 03:01 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:13 - 2013-06-16 03:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-02 12:59 - 2013-06-02 12:59 - 00903072 ____A (Oracle Corporation) C:\Users\Familie Achleitner\Downloads\jxpiinstall.exe
2013-05-30 22:13 - 2013-05-30 22:13 - 00282960 ____A C:\Windows\Minidump\053013-39686-01.dmp
2013-05-30 22:13 - 2010-09-13 17:19 - 00000000 ____D C:\Windows\Minidump
2013-05-30 22:12 - 2010-09-13 17:19 - 364272081 ____A C:\Windows\MEMORY.DMP
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-23 10:32
==================== End Of Log ============================
--- --- --- |
| Themen zu Generics.bex Win7 - abgesicherter Modus nicht möglich - verm. Polizei Trojaner (Österreich) |
| babylontoolbar, bho, canon, converter, driverscanner, dvdvideosoft ltd., firefox, flash player, home, homepage, html/iframe.b.gen, iexplore.exe, install.exe, intranet, mp3, nicht möglich, plug-in, pokki, realtek, rundll, security, senden, smartbar, software, starten, svchost.exe, trojan:js/medfos.b, trojaner, win32/lockscreen.aqd, windows |
Baum-Darstellung