Spybot hat Trojaner FakePorn.winlock erkannt

batzen100 · 01.09.2013, 08:33

Hallo Schraube,

vielen dank für Deine Wo.E. Arbeit. Hier der Log Text von Eset.
Security und FRST folgen.

Danke und Gruss

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a5ec61e55cd7de429a16eb8e83659947
# engine=14968
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-01 06:09:29
# local_time=2013-09-01 08:09:29 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1799 16775165 100 95 7640 148687074 395 0
# scanned=115344
# found=1
# cleaned=0
# scan_time=7283
sh=9B7AFC05F48AE3F56DBE1A2114F8FDF50067A187 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C application" ac=I fn="C:\AdwCleaner\Quarantine\C\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\lq2rlpue.default\Extensions\plugin@getwebcake.com\content\overlay.js.vir"

hier der LogFile von security

Results of screen317's Security Check version 0.99.72
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
Java(TM) 6 Update 18
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (23.0.1)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C::
````````````````````End of Log``````````````````````

... und hier FRST
FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-09-2013
Ran by Steffen (administrator) on STEFFEN-PC on 01-09-2013 08:19:29
Running from C:\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Programme\Bonjour\mDNSResponder.exe
(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe
(Eastman Kodak Company) C:\Programme\Kodak\AiO\Center\ekdiscovery.exe
(Nero AG) C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Intersil Americas Inc.) C:\WINDOWS\system32\PRISMSTA.EXE
() C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe
(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems Incorporated) C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
(Eastman Kodak Company) C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
(X10) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
(Apple Inc.) C:\Programme\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Programme\iPod\bin\iPodService.exe
(ATI Technologies Inc.) C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PRISMSTA.EXE] - PRISMSTA.EXE START [x]
HKLM\...\Run: [StartCCC] - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2010-02-10] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [PCMService] - C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe [61440 2003-06-24] ()
HKLM\...\Run: [Conime] - C:\Windows\system32\conime.exe [27648 2008-04-14] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [149224 2009-12-17] (Sun Microsystems, Inc.)
HKLM\...\Run: [APSDaemon] - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [41208 2012-12-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [EKIJ5000StatusMonitor] - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe [1626112 2009-08-03] (Eastman Kodak Company)
HKLM\...\Run: [iTunesHelper] - C:\Programme\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Programme\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [QuickTime Task] - C:\Programme\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
Winlogon\Notify\AtiExtEvent: Ati2evxx.dll (ATI Technologies Inc.)
HKLM\...\Policies\Explorer: [HonorAutoRunSetting] 1
HKLM\...\Policies\Explorer: [NoDriveAutoRun] 67108863
HKLM\...\Policies\Explorer: [NoDriveTypeAutoRun] 323
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [Snoozer] - C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Snz\Snz.exe [1137673 2013-07-23] ()
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\skype.dat <==== ATTENTION 
HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 323
HKCU\...\Policies\Explorer: [NoDriveAutoRun] 67108863
HKCU\...\Policies\Explorer: [NoDrives] 0
HKU\Rebecca Balke\...\Run: [4Y3Y0C3A9F7XXA4VZLHTPBL] - C:\Recycle.Bin\B6232F3A00A.exe [x]
HKU\Rebecca Balke\...\Run: [A45608C9] - C:\WINDOWS\system32\0DF210FAA45608C949A2.exe [x]
HKU\Rebecca Balke\...\Run: [RebateInformer] - C:\PROGRA~1\REBATE~1\REBATE~1.EXE /STARTUP [x]
HKU\Rebecca Balke\...\RunOnce: [FlashPlayerUpdate] - C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_6_602_180_Plugin.exe -update plugin [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
Toolbar: HKCU -&Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU -Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File
DPF: {5852F5ED-8BF4-11D4-A245-0080C6F74284} hxxp://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Winsock: Catalog5 04 C:\Programme\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 24 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\lq2rlpue.default
FF DefaultSearchEngine: Search
FF SearchEngineOrder.1: Amazon 
FF SelectedSearchEngine: Search
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin - C:\Programme\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Mozilla\Firefox\Profiles\lq2rlpue.default\Extensions\{f0665b34-66b6-4a7f-9dc2-d0dec633395e}
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008 2012-12-21] (Apple Inc.)
S2 ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [593920 2010-02-10] ()
R2 Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [390504 2011-08-30] (Apple Inc.)
R3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [553288 2013-05-31] (Apple Inc.)
R2 Kodak AiO Network Discovery Service; C:\Programme\Kodak\AiO\Center\ekdiscovery.exe [284016 2009-08-05] (Eastman Kodak Company)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [117656 2013-08-22] (Mozilla Foundation)
R2 Nero BackItUp Scheduler 4.0; C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe [935208 2008-09-29] (Nero AG)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S3 ServiceLayer; C:\Programme\PC Connectivity Solution\ServiceLayer.exe [732648 2012-12-19] (Nokia)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
R3 x10nets; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [20480 2001-11-12] (X10)
R2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-20] (Avira Operations GmbH & Co. KG)
R3 Cap7134; C:\Windows\System32\DRIVERS\Cap7134.sys [350752 2003-06-05] (Philips Semiconductors)
R3 cmuda; C:\Windows\System32\drivers\cmuda.sys [745920 2003-09-12] (C-Media Inc)
R3 FETNDISB; C:\Windows\System32\DRIVERS\fetnd5b.sys [40960 2002-10-29] (VIA Technologies, Inc.              )
R3 Intels51; C:\Windows\System32\DRIVERS\ctxs51.sys [638366 2002-07-01] (Intel Corporation)
R3 ms_mpu401; C:\Windows\System32\drivers\msmpu401.sys [2944 2001-08-17] (Microsoft Corporation)
R3 MxlW2k; C:\Windows\System32\Drivers\MxlW2k.sys [28276 2010-03-29] (MusicMatch, Inc.)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R3 pfc; C:\Windows\System32\drivers\pfc.sys [9856 2003-03-20] (Padus, Inc.)
R3 PhTVTune; C:\Windows\System32\DRIVERS\PhTVTune.sys [24704 2003-06-12] (Philips Semiconductors)
R3 PRISM_A00; C:\Windows\System32\DRIVERS\PRISMA00.sys [362688 2003-08-07] (Intersil Americas Inc.)
R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [335104 2008-06-26] (Realtek Semiconductor Corporation                           )
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-20] (Avira GmbH)
S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [31360 2013-02-08] (The OpenVPN Project)
S3 X10UIF; C:\Windows\System32\Drivers\x10uif.sys [10761 2001-11-14] (X10 Wireless Technology, Inc.)
S3 catchme; \??\C:\setup\catchme.sys [x]
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-01 08:17 - 2013-09-01 08:17 - 00000983 _____ C:\Desktop\checkup Security.txt
2013-09-01 08:15 - 2013-09-01 08:15 - 00891115 _____ C:\Desktop\SecurityCheck.exe
2013-08-31 20:12 - 2013-08-31 20:12 - 00000000 __SHD C:\Dokumente und Einstellungen\Steffen\IECompatCache
2013-08-31 20:05 - 2013-08-31 20:05 - 00000000 ____D C:\WINDOWS\ERUNT
2013-08-31 20:04 - 2013-08-31 20:04 - 01027511 _____ (Thisisu) C:\Desktop\JRT.exe
2013-08-31 19:55 - 2013-08-31 19:57 - 00000000 ____D C:\AdwCleaner
2013-08-31 19:29 - 2013-08-31 19:27 - 00994642 _____ C:\Desktop\adwcleaner3001.exe
2013-08-31 19:02 - 2013-08-31 19:02 - 00000416 _____ C:\WINDOWS\Tasks\At1.job
2013-08-31 18:50 - 2013-08-31 19:15 - 00000000 ____D C:\Avenger
2013-08-31 18:15 - 2013-08-31 18:15 - 00000756 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-31 18:15 - 2013-08-31 18:15 - 00000000 ____D C:\Programme\Malwarebytes' Anti-Malware
2013-08-31 18:15 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-08-29 18:51 - 2013-08-29 18:51 - 00023791 _____ C:\ComboFix.txt
2013-08-29 18:42 - 2013-08-29 18:42 - 00008192 ____H C:\WINDOWS\system32\config\SECURITY.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\system.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\software.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\SAM.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\default.tmp.LOG
2013-08-29 18:34 - 2013-08-27 05:02 - 00000245 _____ C:\Boot.bak
2013-08-29 18:33 - 2013-08-29 18:34 - 00000000 _RSHD C:\cmdcons
2013-08-29 18:33 - 2004-08-03 23:00 - 00262448 __RSH C:\cmldr
2013-08-29 18:31 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-08-29 18:31 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-08-29 18:31 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-08-29 18:31 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-08-29 18:31 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-08-29 18:31 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-08-29 18:31 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-08-29 18:31 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-08-29 18:31 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-08-29 18:29 - 2013-08-29 18:51 - 00000000 ____D C:\Qoobox
2013-08-29 18:29 - 2013-08-29 18:48 - 00000000 ____D C:\WINDOWS\erdnt
2013-08-29 18:26 - 2013-08-29 18:26 - 00002043 _____ C:\Desktop\Search.lnk
2013-08-28 20:12 - 2013-08-28 20:12 - 00005701 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 20:12 - 2013-08-28 20:12 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-28 19:15 - 2013-08-28 19:15 - 00000000 ____D C:\FRST
2013-08-22 19:35 - 2013-08-27 17:15 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-08-22 18:47 - 2013-08-22 18:47 - 00000000 ____D C:\Programme\QuickTime
2013-08-21 11:12 - 2013-08-21 11:12 - 00000000 ____D C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Avira
2013-08-21 11:06 - 2013-08-21 11:06 - 00001671 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
2013-08-21 11:06 - 2013-08-20 11:47 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-08-21 11:06 - 2013-08-20 11:47 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-08-21 11:06 - 2013-08-20 11:47 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2013-08-21 11:06 - 2013-08-20 11:47 - 00028520 _____ (Avira GmbH) C:\WINDOWS\system32\Drivers\ssmdrv.sys
2013-08-21 11:05 - 2013-08-21 11:05 - 00000000 ____D C:\Programme\Avira
2013-08-20 14:04 - 2013-08-20 14:05 - 00018803 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-20 13:52 - 2013-08-20 14:04 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-08-20 13:51 - 2013-08-20 13:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-20 13:50 - 2013-08-20 13:50 - 00012027 _____ C:\WINDOWS\KB2863058.log
2013-08-20 13:50 - 2013-08-20 13:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-20 13:50 - 2013-08-20 13:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-20 13:50 - 2013-08-20 13:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-20 11:50 - 2013-08-20 11:50 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_netaapl_01009.Wdf
2013-08-20 11:40 - 2013-08-20 13:51 - 00016838 _____ C:\WINDOWS\KB2850869.log
2013-08-20 11:39 - 2013-08-20 13:50 - 00018522 _____ C:\WINDOWS\KB2859537.log
2013-08-09 17:13 - 2013-08-09 17:13 - 00000000 ____D C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Snz

==================== One Month Modified Files and Folders =======

2013-09-01 08:17 - 2013-09-01 08:17 - 00000983 _____ C:\Desktop\checkup Security.txt
2013-09-01 08:15 - 2013-09-01 08:15 - 00891115 _____ C:\Desktop\SecurityCheck.exe
2013-09-01 08:14 - 2010-02-04 01:02 - 01258742 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-01 08:14 - 2010-02-04 00:54 - 00000000 ___RD C:\Programme
2013-09-01 07:20 - 2013-04-01 12:04 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-01 06:00 - 2010-02-04 00:54 - 01052368 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-09-01 05:56 - 2010-06-04 19:45 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-09-01 05:56 - 2010-06-04 19:45 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-09-01 05:56 - 2010-02-04 01:12 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-08-31 20:43 - 2010-03-29 14:56 - 00524288 _____ C:\WINDOWS\system32\config\ACEEvent.evt
2013-08-31 20:43 - 2010-02-04 01:12 - 00032140 _____ C:\WINDOWS\SchedLgU.Txt
2013-08-31 20:42 - 2010-03-29 13:40 - 00000300 ___SH C:\Dokumente und Einstellungen\Steffen\ntuser.ini
2013-08-31 20:12 - 2013-08-31 20:12 - 00000000 __SHD C:\Dokumente und Einstellungen\Steffen\IECompatCache
2013-08-31 20:05 - 2013-08-31 20:05 - 00000000 ____D C:\WINDOWS\ERUNT
2013-08-31 20:04 - 2013-08-31 20:04 - 01027511 _____ (Thisisu) C:\Desktop\JRT.exe
2013-08-31 19:57 - 2013-08-31 19:55 - 00000000 ____D C:\AdwCleaner
2013-08-31 19:56 - 2013-06-09 17:53 - 00000000 ____D C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Common
2013-08-31 19:56 - 2010-03-29 13:40 - 00000000 ___RD C:\Startmenü\Programme
2013-08-31 19:27 - 2013-08-31 19:29 - 00994642 _____ C:\Desktop\adwcleaner3001.exe
2013-08-31 19:15 - 2013-08-31 18:50 - 00000000 ____D C:\Avenger
2013-08-31 19:15 - 2011-06-14 21:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB970430$
2013-08-31 19:02 - 2013-08-31 19:02 - 00000416 _____ C:\WINDOWS\Tasks\At1.job
2013-08-31 18:50 - 2010-03-29 15:10 - 00000000 ____D C:\WINDOWS\ie8updates
2013-08-31 18:15 - 2013-08-31 18:15 - 00000756 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-31 18:15 - 2013-08-31 18:15 - 00000000 ____D C:\Programme\Malwarebytes' Anti-Malware
2013-08-31 18:07 - 2001-08-23 15:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2013-08-29 19:19 - 2010-02-04 01:12 - 00000000 __SHD C:\Dokumente und Einstellungen\NetworkService
2013-08-29 18:51 - 2013-08-29 18:51 - 00023791 _____ C:\ComboFix.txt
2013-08-29 18:51 - 2013-08-29 18:29 - 00000000 ____D C:\Qoobox
2013-08-29 18:48 - 2013-08-29 18:29 - 00000000 ____D C:\WINDOWS\erdnt
2013-08-29 18:45 - 2001-08-23 15:00 - 00000227 _____ C:\WINDOWS\system.ini
2013-08-29 18:43 - 2010-02-04 01:52 - 31457280 _____ C:\WINDOWS\system32\config\software.bak
2013-08-29 18:43 - 2010-02-04 01:52 - 08912896 _____ C:\WINDOWS\system32\config\system.bak
2013-08-29 18:43 - 2010-02-04 01:52 - 00524288 _____ C:\WINDOWS\system32\config\default.bak
2013-08-29 18:43 - 2010-02-04 00:53 - 00262144 _____ C:\WINDOWS\system32\config\SECURITY.bak
2013-08-29 18:43 - 2010-02-04 00:53 - 00262144 _____ C:\WINDOWS\system32\config\SAM.bak
2013-08-29 18:42 - 2013-08-29 18:42 - 00008192 ____H C:\WINDOWS\system32\config\SECURITY.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\system.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\software.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\SAM.tmp.LOG
2013-08-29 18:42 - 2013-08-29 18:42 - 00000000 ____H C:\WINDOWS\system32\config\default.tmp.LOG
2013-08-29 18:34 - 2013-08-29 18:33 - 00000000 _RSHD C:\cmdcons
2013-08-29 18:34 - 2010-02-04 01:52 - 00000355 __RSH C:\boot.ini
2013-08-29 18:26 - 2013-08-29 18:26 - 00002043 _____ C:\Desktop\Search.lnk
2013-08-28 20:12 - 2013-08-28 20:12 - 00005701 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 20:12 - 2013-08-28 20:12 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-28 20:12 - 2010-06-04 19:39 - 01856056 _____ C:\WINDOWS\iis6.log
2013-08-28 20:12 - 2010-06-04 19:39 - 01508519 _____ C:\WINDOWS\FaxSetup.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00830586 _____ C:\WINDOWS\ocgen.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00721829 _____ C:\WINDOWS\tsoc.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00511776 _____ C:\WINDOWS\msmqinst.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00504553 _____ C:\WINDOWS\comsetup.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00315813 _____ C:\WINDOWS\ntdtcsetup.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00268653 _____ C:\WINDOWS\netfxocm.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00108998 _____ C:\WINDOWS\MedCtrOC.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00086108 _____ C:\WINDOWS\ocmsn.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00078900 _____ C:\WINDOWS\msgsocm.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00073940 _____ C:\WINDOWS\tabletoc.log
2013-08-28 20:12 - 2010-06-04 19:39 - 00001374 _____ C:\WINDOWS\imsins.log
2013-08-28 20:11 - 2010-03-29 13:40 - 00000000 __SHD C:\DOKUME~1\Steffen\LOKALE~1\Verlauf
2013-08-28 19:15 - 2013-08-28 19:15 - 00000000 ____D C:\FRST
2013-08-27 17:15 - 2013-08-22 19:35 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-08-27 05:06 - 2010-02-04 01:01 - 00000000 ____D C:\WINDOWS\system32\Restore
2013-08-27 05:02 - 2013-08-29 18:34 - 00000245 _____ C:\Boot.bak
2013-08-27 04:36 - 2010-02-04 01:48 - 00000000 ___RD C:\WINDOWS\Web
2013-08-27 02:11 - 2011-06-19 14:08 - 00000664 _____ C:\WINDOWS\system32\d3d9caps.dat
2013-08-26 19:05 - 2010-02-04 01:16 - 00000000 ____D C:\WINDOWS\system32\NtmsData
2013-08-26 17:46 - 2010-02-04 01:00 - 00000000 ____D C:\WINDOWS\Registration
2013-08-23 07:52 - 2012-04-27 19:45 - 00000000 ____D C:\Programme\Mozilla Maintenance Service
2013-08-22 21:46 - 2013-02-13 19:23 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2778344$
2013-08-22 18:57 - 2012-06-10 17:49 - 00000000 ____D C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Apple Computer
2013-08-22 18:47 - 2013-08-22 18:47 - 00000000 ____D C:\Programme\QuickTime
2013-08-21 11:12 - 2013-08-21 11:12 - 00000000 ____D C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Avira
2013-08-21 11:06 - 2013-08-21 11:06 - 00001671 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
2013-08-21 11:05 - 2013-08-21 11:05 - 00000000 ____D C:\Programme\Avira
2013-08-20 14:05 - 2013-08-20 14:04 - 00018803 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-20 14:05 - 2010-06-04 19:39 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-08-20 14:05 - 2010-06-04 19:32 - 00318730 _____ C:\WINDOWS\updspapi.log
2013-08-20 14:04 - 2013-08-20 13:52 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-08-20 13:59 - 2010-03-29 14:50 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-08-20 13:51 - 2013-08-20 13:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-20 13:51 - 2013-08-20 11:40 - 00016838 _____ C:\WINDOWS\KB2850869.log
2013-08-20 13:51 - 2010-03-29 15:02 - 75778376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-08-20 13:50 - 2013-08-20 13:50 - 00012027 _____ C:\WINDOWS\KB2863058.log
2013-08-20 13:50 - 2013-08-20 13:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-20 13:50 - 2013-08-20 13:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-20 13:50 - 2013-08-20 13:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-20 13:50 - 2013-08-20 11:39 - 00018522 _____ C:\WINDOWS\KB2859537.log
2013-08-20 13:50 - 2011-06-03 15:58 - 00032864 _____ C:\WINDOWS\system32\TZLog.log
2013-08-20 13:42 - 2011-06-21 19:10 - 00000177 _____ C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\default.rss
2013-08-20 13:41 - 2011-06-21 19:09 - 00000069 _____ C:\WINDOWS\NeroDigital.ini
2013-08-20 13:06 - 2010-03-29 13:40 - 00000000 ___RD C:\Eigene Dateien\Eigene Bilder
2013-08-20 11:50 - 2013-08-20 11:50 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_netaapl_01009.Wdf
2013-08-20 11:50 - 2010-06-04 19:39 - 00008973 _____ C:\WINDOWS\setupact.log
2013-08-20 11:50 - 2010-04-19 16:48 - 00466150 _____ C:\WINDOWS\setupapi.log
2013-08-20 11:47 - 2013-08-21 11:06 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-08-20 11:47 - 2013-08-21 11:06 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-08-20 11:47 - 2013-08-21 11:06 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2013-08-20 11:47 - 2013-08-21 11:06 - 00028520 _____ (Avira GmbH) C:\WINDOWS\system32\Drivers\ssmdrv.sys
2013-08-09 17:13 - 2013-08-09 17:13 - 00000000 ____D C:\Dokumente und Einstellungen\Steffen\Anwendungsdaten\Snz
2013-08-03 01:48 - 2010-03-29 14:40 - 01543680 ____N (Microsoft Corporation) C:\WINDOWS\system32\wmvdecod.dll

Files to move or delete:
====================
C:\DOKUME~1\Steffen\LOKALE~1\Temp\Quarantine.exe
C:\DOKUME~1\Steffen\LOKALE~1\Temp\nsz6F.tmp\nsJSON.dll
C:\DOKUME~1\Steffen\LOKALE~1\Temp\jrt\erunt\ERUNT.EXE
C:\DOKUME~1\Steffen\LOKALE~1\Temp\is357113909\chrome_logic.exe
C:\DOKUME~1\Steffen\LOKALE~1\Temp\is357113909\OpenItSetup.exe
C:\DOKUME~1\Steffen\LOKALE~1\Temp\is357113909\wajam_validate.exe
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\BExternal.dll
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\BUSolForMontiera.dll
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\ccp.exe
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\ChromeToolbarSetup.dll
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\CrxInstaller.dll
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\GUninstaller.exe
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\IEHelper.dll
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\MntrDLLInstall.dll
C:\DOKUME~1\Steffen\LOKALE~1\Temp\3A25EE91-BAB0-7891-9F45-E2ED5759D956\Latest\sqlite3.dll
C:\Windows\Tasks\At1.job

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2006-01-24 15:23] - [2008-04-14 07:52] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e 

C:\Windows\System32\winlogon.exe
[2004-08-04 02:58] - [2008-04-14 07:53] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a 

C:\Windows\System32\svchost.exe
[2004-08-04 02:58] - [2008-04-14 07:53] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366 

C:\Windows\System32\services.exe
[2004-08-04 02:58] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc 

C:\Windows\System32\User32.dll
[2006-01-24 15:24] - [2008-04-14 07:52] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd 

C:\Windows\System32\userinit.exe
[2004-08-04 02:58] - [2008-04-14 07:53] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106 

C:\Windows\System32\Drivers\volsnap.sys
[2004-08-04 02:44] - [2008-04-14 07:22] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d 


==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Hallo Schrauber,

Avira hat gerade folgende Meldung gebracht:

C:/System Volume Information/....../A0000357 exe enthält ein Virus Adware/Adware.Gen7. wurde verweigert. ???

Noch eine Frage: Habe diesen Eset Scan mit meiner externen Festplatte durchgeführt. Habe noch 4 Sticks - müssen die auch geprüft werden oder kann ich dies irgendwie anders prüfen??

Danke.

Spybot hat Trojaner FakePorn.winlock erkannt

Plagegeister aller Art und deren Bekämpfung: Spybot hat Trojaner FakePorn.winlock erkannt

Spybot hat Trojaner FakePorn.winlock erkannt

Ähnliche Themen: Spybot hat Trojaner FakePorn.winlock erkannt