| |
| |||||||
Log-Analyse und Auswertung: Avast meldet infizierte Datei: Win32:Kryptik-JUW [Trj]Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
03.08.2013, 16:57
| #1 |
| | ![Avast meldet infizierte Datei: Win32:Kryptik-JUW [Trj] - Standard](images/icons/icon1.gif){kind=icon} Avast meldet infizierte Datei: Win32:Kryptik-JUW [Trj] Hallo zusammen, ich bin neu hier und hoffe, ihr könnt mir helfen. Heute morgen hat Avast Antivirus bei einer Startzeit-Überprüfung eine infizierte Datei gefunden und in den Container verschoben. Ich bin nicht sicher, ob es das richtige Log-File ist - es gibt da ungefähr 10 txt-Dateien: Code:
ATTFilter 08/03/2013 10:49
Prüfung aller lokalen Laufwerke
Datei C:\Users\Katrin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\3bfdbe40-18808f77 ist infiziert von Win32:Kryptik-JUW [Trj], In Container verschoben
Anzahl durchsuchter Ordner: 78021
Anzahl der geprüften Dateien: 443480
Anzahl infizierter Dateien: 1
1. Seit einigen Wochen öffnet sich im Firefox Browser immer wieder ein neuer Tab mit Werbung. Die Adressen sind unterschiedlich, hier die letzte: hxxp://m.bingoodthingshappen.com/t/?ilmernzkvtazn=00225F8333E2F87F&pu=&s=D-firefox&nm=ilmernzkvtazn&t= Ich hatte danach gegoogelt und zu einer der Adressen den Tipp gefunden, das Browser-Plugin NoScript zu installieren. Seitdem kommt die Seite sehr viel seltener und wenn, dann steht dort nur noch "why am I seeing this ad?click here". Da das Virenprogramm bisher nicht gefunden hatte, bin ich davon ausgegangen, dass alles ok ist (naiv, ich weiß...) 2. Mein Rechner ist unheimlich langsam. Ich dachte eigentlich, das liegt an der beinahe vollen Festplatte (nur noch 50 GB / 300 GB frei). Jetzt bin ich mir da nicht mehr so sicher. Log-Files Hier die Logfiles, die laut eurer Anleitung benötigt werden, um das Problem zu finden und zu helfen: 1. defogger_Disable Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:27 on 03/08/2013 (Katrin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-08-2013 01
Ran by Katrin (administrator) on 03-08-2013 15:32:14
Running from C:\Users\Katrin\Downloads
Microsoft® Windows Vista™ Business Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Dell Inc.) C:\Windows\System32\bcmwltry.exe
(AVAST Software) C:\Program Files\Sicherheit\AvastSvc.exe
(Andrea Electronics Corporation) C:\Windows\system32\AERTSrv.exe
(O2Micro International) C:\Windows\system32\DRIVERS\o2flash.exe
() C:\Program Files\Verbindungsassistent\wtgservice.exe
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Creative Technology Ltd.) C:\Windows\OEM13Mon.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(AVAST Software) C:\Program Files\Sicherheit\AvastUI.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Dropbox, Inc.) C:\Users\Katrin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(J. Rathlev, IEAP, Uni-Kiel) C:\Program Files\Hilfreiches\Personal Backup 5\Persbackup.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\msinfo32.exe
(Dominik Reichl) C:\Users\Katrin\13 - Programme Portable\KeePass-2.22\KeePass.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [159744 2008-02-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4907008 2008-02-22] (Realtek Semiconductor)
HKLM\...\Run: [OEM13Mon.exe] - C:\Windows\OEM13Mon.exe [36864 2008-07-17] (Creative Technology Ltd.)
HKLM\...\Run: [DELL Webcam Manager] - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [118784 2007-07-27] (Creative Technology Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\system32\WLTRAY.exe [3810304 2008-12-18] (Dell Inc.)
HKLM\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1451304 2009-03-20] (Synaptics Incorporated)
HKLM\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [520192 2006-12-14] ()
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339312 2010-09-15] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [avast] - C:\Program Files\Sicherheit\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [CitrixReceiver] - "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk" [x]
HKLM\...\Run: [ConnectionCenter] - C:\Program Files\Citrix\ICA Client\concentr.exe [380088 2012-07-27] (Citrix Systems, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\Multimedia\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKCU\...\Run: [ISUSPM] - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation)
HKCU\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
MountPoints2: F - F:\AutoRun.exe
MountPoints2: {0eb16ce0-a35d-11de-ad54-002170ef5cdc} - F:\AutoRun.exe
MountPoints2: {0eb16cf3-a35d-11de-ad54-002170ef5cdc} - G:\AutoRun.exe
MountPoints2: {0eb16d18-a35d-11de-ad54-002170ef5cdc} - G:\AutoRun.exe
MountPoints2: {0eb16d20-a35d-11de-ad54-002170ef5cdc} - F:\AutoRun.exe
MountPoints2: {0eb16d24-a35d-11de-ad54-002170ef5cdc} - F:\AutoRun.exe
MountPoints2: {9ac98d94-c675-11e0-b1f3-002170ef5cdc} - F:\AutoRun.exe
MountPoints2: {9ac98d95-c675-11e0-b1f3-002170ef5cdc} - F:\AutoRun.exe
MountPoints2: {a7afb75a-30fc-11de-a867-002170ef5cdc} - F:\WDSetup.exe
MountPoints2: {ccdd18d9-46ee-11de-af60-002170ef5cdc} - F:\PStart.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk
ShortcutTarget: Persbackup.lnk -> C:\Program Files\Hilfreiches\Personal Backup 5\Persbackup.exe (J. Rathlev, IEAP, Uni-Kiel)
Startup: C:\Users\Katrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Katrin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Katrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk
ShortcutTarget: Persbackup.lnk -> C:\Program Files\Hilfreiches\Personal Backup 5\Persbackup.exe (J. Rathlev, IEAP, Uni-Kiel)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/8
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de
SearchScopes: HKLM - DefaultScope {441F7098-957B-4528-8809-9098A972774A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&Form=DLSDF7&pc=MDDS&src={referrer:source?}
SearchScopes: HKLM - {441F7098-957B-4528-8809-9098A972774A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&Form=DLSDF7&pc=MDDS&src={referrer:source?}
SearchScopes: HKCU - DefaultScope {4C2094D0-45EB-44C6-99D3-C4A34E9FEA86} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {441F7098-957B-4528-8809-9098A972774A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=DLSDF7&pc=MDDS&src=IE-SearchBox
SearchScopes: HKCU - {4C2094D0-45EB-44C6-99D3-C4A34E9FEA86} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Sicherheit\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Sicherheit\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU -No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
Handler: haufereader - No CLSID Value -
Handler: msdaipp - No CLSID Value -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default
FF user.js: detected! => C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default\user.js
FF SelectedSearchEngine: Wikipedia (de)
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @Citrix.com/npican - C:\Program Files\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF Extension: No Name - C:\Users\Katrin\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: No Name - C:\Users\Katrin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default\Extensions\collector@broceliand.fr
FF Extension: KeeFox - C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default\Extensions\keefox@chris.tomlinson
FF Extension: Evernote Web Clipper - C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
FF Extension: feedly - C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default\Extensions\feedly@devhd.xpi
FF Extension: pinterest-addon - C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default\Extensions\pinterest-addon@felixfung.ca.xpi
FF Extension: No Name - C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\6ggu3ans.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\Sicherheit\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Sicherheit\WebRep\FF
========================== Services (Whitelisted) =================
R2 AERTFilters; C:\Windows\system32\AERTSrv.exe [77824 2008-02-22] (Andrea Electronics Corporation)
R2 avast! Antivirus; C:\Program Files\Sicherheit\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 O2FLASH; C:\Windows\system32\DRIVERS\o2flash.exe [71512 2008-11-05] (O2Micro International)
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2809856 2008-12-18] (Dell Inc.)
R2 WTGService; C:\Program Files\Verbindungsassistent\wtgservice.exe [330696 2011-01-29] ()
S3 [verify-U]; C:\Program Files\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG)
S2 Norton Internet Security; "C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1 [x]
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [x]
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [49760 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [175176 2013-06-28] ()
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-12-18] (Broadcom Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [41984 2006-12-08] (Samsung Electronics Co., Ltd.)
R3 OEM13Vfx; C:\Windows\System32\DRIVERS\OEM13Vfx.sys [7424 2008-07-17] (EyePower Games Pte. Ltd.)
R3 OEM13Vid; C:\Windows\System32\DRIVERS\OEM13Vid.sys [235840 2008-07-17] (Creative Technology Ltd.)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [16472 2012-01-18] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [11104 2012-01-18] ()
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2006-12-08] (Samsung Electronics)
R1 [verify-U]_System; C:\Windows\System32\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG)
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090125.005\NAVENG.SYS [x]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090125.005\NAVEX15.SYS [x]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [x]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x]
S3 PCDSRVC{5B8A2B68-04D6B966-06020200}_0; \??\c:\program files\my dell\pcdsrvc.pkms [x]
S1 SRTSP; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS [x]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-03 15:25 - 2013-08-03 15:27 - 00019830 _____ C:\Users\Katrin\Downloads\Addition.txt
2013-08-03 15:25 - 2013-08-03 15:25 - 00000000 ____D C:\FRST
2013-08-03 15:23 - 2013-08-03 15:23 - 00000474 _____ C:\Users\Katrin\Downloads\defogger_disable.log
2013-08-03 15:23 - 2013-08-03 15:23 - 00000000 _____ C:\Users\Katrin\defogger_reenable
2013-08-03 15:22 - 2013-08-03 15:22 - 01222124 _____ (Farbar) C:\Users\Katrin\Downloads\FRST.exe
2013-08-03 15:22 - 2013-08-03 15:22 - 00377856 _____ C:\Users\Katrin\Downloads\gmer_2.1.19163.exe
2013-08-03 15:18 - 2013-08-03 15:18 - 00050477 _____ C:\Users\Katrin\Downloads\Defogger.exe
2013-08-03 10:46 - 2013-08-03 10:46 - 16981320 _____ C:\Users\Katrin\Downloads\pb-setup-5.4.8.2.zip
2013-08-03 10:45 - 2013-08-03 10:45 - 00000000 _____ C:\Users\Katrin\Downloads\personal_backup
2013-08-03 10:23 - 2013-08-03 10:23 - 00000218 _____ C:\Users\Katrin\.recently-used.xbel
2013-07-27 09:38 - 2013-07-30 20:26 - 00000073 _____ C:\Users\Katrin\AppData\Roaming\WB.CFG
2013-07-22 21:12 - 2013-07-22 21:12 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-21 21:18 - 2013-07-21 21:18 - 00000000 __RSH C:\MSDOS.SYS
2013-07-21 21:18 - 2013-07-21 21:18 - 00000000 __RSH C:\IO.SYS
2013-07-16 11:07 - 2013-07-16 11:07 - 00000441 _____ C:\Windows\wininit.ini
2013-07-16 08:51 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-16 08:51 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-16 08:51 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-16 08:51 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-16 08:51 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-16 08:51 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-16 08:51 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-16 08:51 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-16 08:51 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-16 08:51 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-16 08:51 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-16 08:51 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-16 08:51 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-16 08:51 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-16 08:51 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-16 08:51 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-16 08:33 - 2013-06-04 03:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-16 08:33 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-16 08:33 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-16 08:33 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-16 08:33 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-16 08:33 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-16 08:33 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-16 08:33 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-16 08:33 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-16 08:33 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-16 08:33 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-16 08:33 - 2013-04-17 12:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-14 11:07 - 2013-07-16 09:57 - 00000000 ____D C:\Windows\system32\MRT
==================== One Month Modified Files and Folders =======
2013-08-03 15:27 - 2013-08-03 15:25 - 00019830 _____ C:\Users\Katrin\Downloads\Addition.txt
2013-08-03 15:25 - 2013-08-03 15:25 - 00000000 ____D C:\FRST
2013-08-03 15:23 - 2013-08-03 15:23 - 00000474 _____ C:\Users\Katrin\Downloads\defogger_disable.log
2013-08-03 15:23 - 2013-08-03 15:23 - 00000000 _____ C:\Users\Katrin\defogger_reenable
2013-08-03 15:23 - 2009-04-22 19:27 - 00000000 ____D C:\Users\Katrin
2013-08-03 15:22 - 2013-08-03 15:22 - 01222124 _____ (Farbar) C:\Users\Katrin\Downloads\FRST.exe
2013-08-03 15:22 - 2013-08-03 15:22 - 00377856 _____ C:\Users\Katrin\Downloads\gmer_2.1.19163.exe
2013-08-03 15:18 - 2013-08-03 15:18 - 00050477 _____ C:\Users\Katrin\Downloads\Defogger.exe
2013-08-03 15:08 - 2012-04-11 13:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-03 14:35 - 2009-04-16 23:40 - 01830846 _____ C:\Windows\WindowsUpdate.log
2013-08-03 14:32 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-03 14:32 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-03 14:31 - 2010-06-20 17:36 - 00000000 ___RD C:\Users\Katrin\Dropbox
2013-08-03 14:31 - 2010-06-20 17:33 - 00000000 ____D C:\Users\Katrin\AppData\Roaming\Dropbox
2013-08-03 14:27 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-03 14:27 - 2006-11-02 15:00 - 00303520 _____ C:\Windows\PFRO.log
2013-08-03 10:47 - 2006-11-02 15:01 - 00032538 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-03 10:46 - 2013-08-03 10:46 - 16981320 _____ C:\Users\Katrin\Downloads\pb-setup-5.4.8.2.zip
2013-08-03 10:46 - 2008-01-21 10:32 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-03 10:45 - 2013-08-03 10:45 - 00000000 _____ C:\Users\Katrin\Downloads\personal_backup
2013-08-03 10:23 - 2013-08-03 10:23 - 00000218 _____ C:\Users\Katrin\.recently-used.xbel
2013-08-03 10:12 - 2009-04-25 10:15 - 00000000 ____D C:\Program Files\Multimedia
2013-08-03 09:59 - 2011-07-10 12:51 - 00000000 ____D C:\Program Files\Google
2013-08-03 09:56 - 2011-07-10 12:51 - 00000000 ____D C:\Users\Katrin\AppData\Local\Google
2013-08-03 09:53 - 2006-11-02 12:23 - 00002577 _____ C:\Windows\system32\config.nt
2013-08-03 09:52 - 2011-11-07 21:24 - 00000000 ____D C:\Program Files\Sicherheit
2013-08-02 20:26 - 2013-07-01 23:16 - 00000005 _____ C:\Users\Katrin\AppData\Roaming\WBPU-TTL.DAT
2013-07-30 20:35 - 2010-04-28 21:38 - 00000680 _____ C:\Users\Katrin\AppData\Local\d3d9caps.dat
2013-07-30 20:26 - 2013-07-27 09:38 - 00000073 _____ C:\Users\Katrin\AppData\Roaming\WB.CFG
2013-07-26 20:31 - 2013-05-22 20:24 - 00000000 ____D C:\Program Files\My Dell
2013-07-26 20:31 - 2011-06-01 23:15 - 00000000 ____D C:\ProgramData\PCDr
2013-07-22 21:12 - 2013-07-22 21:12 - 00000000 ____D C:\ProgramData\Apple Computer
2013-07-22 21:04 - 2012-04-11 13:26 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-22 21:04 - 2011-05-22 13:34 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-07-21 21:18 - 2013-07-21 21:18 - 00000000 __RSH C:\MSDOS.SYS
2013-07-21 21:18 - 2013-07-21 21:18 - 00000000 __RSH C:\IO.SYS
2013-07-16 11:07 - 2013-07-16 11:07 - 00000441 _____ C:\Windows\wininit.ini
2013-07-16 09:57 - 2013-07-14 11:07 - 00000000 ____D C:\Windows\system32\MRT
2013-07-16 09:49 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-16 09:27 - 2006-11-02 14:47 - 00361656 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-16 09:25 - 2009-04-16 22:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-16 09:23 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-07-16 09:02 - 2011-11-06 23:08 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-16 09:02 - 2011-08-13 11:43 - 00000000 ____D C:\Users\Katrin\AppData\Roaming\PersBackup5
2013-07-16 09:02 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-07-16 09:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-07-16 09:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-07-16 09:02 - 2006-11-02 12:22 - 49545216 _____ C:\Windows\system32\config\software_previous
2013-07-16 09:02 - 2006-11-02 12:22 - 31457280 _____ C:\Windows\system32\config\system_previous
2013-07-16 09:01 - 2012-04-24 20:26 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-16 09:01 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-07-16 08:53 - 2013-01-04 22:53 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-16 08:53 - 2006-11-02 12:22 - 42205184 _____ C:\Windows\system32\config\components_previous
2013-07-16 08:53 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-07-16 08:34 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-16 08:27 - 2009-04-25 11:18 - 00000000 ____D C:\Users\Katrin\AppData\Local\Adobe
2013-07-16 07:49 - 2006-11-02 12:22 - 00524288 _____ C:\Windows\system32\config\default_previous
2013-07-16 07:49 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
Files to move or delete:
====================
C:\ProgramData\firstlsp.reg.dat
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-03 14:36
==================== End Of Log ============================
|
| Themen zu Avast meldet infizierte Datei: Win32:Kryptik-JUW [Trj] |
| adobe, browser, explorer, farbar, farbar recovery scan tool, festplatte, flash player, homepage, infizierte datei, java/exploit.cve-2012-5076.b, kryptik, plug-in, problem, programm, safer networking, services.exe, sicherheit, software, svchost.exe, system, trojaner, unterschiedlich, werbung in neuem tab, win32/bagle.gen.zip, win32/kryptik.almw, windows, öffnet |
![Avast meldet infizierte Datei: Win32:Kryptik-JUW [Trj]](iconimages/log-analyse-auswertung/avast-meldet-infizierte-datei-win32-kryptik-juw-trj_ltr.gif)
Baum-Darstellung