![]() |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Verdacht auf Spamversand - Avira Boot CD meldet 3 FundeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() |
| |
| | #1 |
| /// the machine /// TB-Ausbilder ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() | Verdacht auf Spamversand - Avira Boot CD meldet 3 FundeESET Online Scanner
Downloade Dir bitte
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
| | #2 |
![]() ![]() | Verdacht auf Spamversand - Avira Boot CD meldet 3 Funde ESET läuft grad...
__________________Sag Du's mir ![]() Hi, Ist wohl noch was auf dem System...? Hier das ESET Log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=83c4790dc624f943832a3a8e2c32d512
# engine=15826
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-10 10:30:53
# local_time=2013-11-10 11:30:53 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# scanned=67401
# found=1
# cleaned=0
# scan_time=12785
# nod_component=V3 Build:0x30000000
sh=6D93926AA6FFA7541EE299A7DD0A79F6D4124934 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.PMG trojan" ac=I fn="C:\Dokumente und Einstellungen\Administrator.*****\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\39\419e9da7-3bcf72ae.vir"
Log von Security Check: Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows XP Service Pack 3 x86 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! ESET Endpoint Antivirus 5.0 Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Java version out of Date! Adobe Reader 9 Adobe Reader out of Date! Adobe Reader 10.1.8 Adobe Reader out of Date! Mozilla Thunderbird 15.0. Thunderbird out of Date! Google Chrome 30.0.1599.101 ````````Process Check: objlist.exe by Laurent```````` ESET NOD32 Antivirus egui.exe ESET NOD32 Antivirus ekrn.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: ````````````````````End of Log`````````````````````` Und nochmal frst: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Administrator (administrator) on ***** on 10-11-2013 23:37:44
Running from C:\Dokumente und Einstellungen\Administrator.*****\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(ESET) C:\Programme\ESET\ESET Endpoint Antivirus\ekrn.exe
(Oracle Corporation) C:\Programme\Java\jre7\bin\jqs.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
(Microsoft Corporation) c:\Programme\Zune\ZuneBusEnum.exe
(Adobe Systems Inc.) C:\Programme\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\SOUNDMAN.EXE
(Microsoft Corporation) C:\Programme\Zune\ZuneLauncher.exe
(ESET) C:\Programme\ESET\ESET Endpoint Antivirus\egui.exe
(Oracle Corporation) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Akamai Technologies, Inc.) C:\Dokumente und Einstellungen\Administrator.*****\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe
(Google Inc.) C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Akamai Technologies, Inc.) C:\Dokumente und Einstellungen\Administrator.*****\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe
(telegate MEDIA AG) C:\Klicktel\kmon.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Programme\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM\...\Run: [pdfFactory Pro Dispatcher v3] - C:\WINDOWS\system32\spool\drivers\w32x86\3\fppdis3a.exe [614400 2009-12-15] (FinePrint Software, LLC)
HKLM\...\Run: [SoundMan] - C:\WINDOWS\SoundMan.exe [86016 2006-07-21] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Zune Launcher] - C:\Programme\Zune\ZuneLauncher.exe [159456 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [egui] - C:\Programme\ESET\ESET Endpoint Antivirus\egui.exe [3158584 2013-02-14] (ESET)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKCU\...\Run: [Akamai NetSession Interface] - C:\Dokumente und Einstellungen\Administrator.*****\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [swg] - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-05-29] (Google Inc.)
Startup: C:\Dokumente und Einstellungen\Administrator.*****\Startmenü\Programme\Autostart\Telefon- und Branchenbuch + Rückwärtssuche Frühjahr 2013 - Inversmonitor.lnk
ShortcutTarget: Telefon- und Branchenbuch + Rückwärtssuche Frühjahr 2013 - Inversmonitor.lnk -> C:\Klicktel\kmon.exe (telegate MEDIA AG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x364D01BABAB5CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {4638D967-EEFC-4ECE-B1EA-B39554D0026D} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
BHO: Ask Toolbar - {4F524A2D-5637-006A-76A7-7A786E7484D7} - "C:\Programme\AskPartnerNetwork\Toolbar\ORJ-V7\Passport.dll" No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: G Data BankGuard - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Programme\Gemeinsame Dateien\G Data\AVKProxy\BanksafeBHO.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Ask Toolbar - {4F524A2D-5637-006A-76A7-7A786E7484D7} - "C:\Programme\AskPartnerNetwork\Toolbar\ORJ-V7\Passport.dll" No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Ask Toolbar - {4F524A2D-5637-006A-76A7-7A786E7484D7} - "C:\Programme\AskPartnerNetwork\Toolbar\ORJ-V7\Passport.dll" No File
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Dokumente und Einstellungen\Administrator.*****\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Programme\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Programme\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE DRM) - C:\Programme\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Microsoft\u00AE DRM) - C:\Programme\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Programme\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Google Update) - C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (YouTube) - C:\DOKUME~1\ADMINI~1.SCH\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\DOKUME~1\ADMINI~1.SCH\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Chrome In-App Payments service) - C:\DOKUME~1\ADMINI~1.SCH\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\DOKUME~1\ADMINI~1.SCH\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2
========================== Services (Whitelisted) =================
S3 EhttpSrv; C:\Programme\ESET\ESET Endpoint Antivirus\EHttpSrv.exe [33136 2013-02-14] (ESET)
R2 ekrn; C:\Programme\ESET\ESET Endpoint Antivirus\ekrn.exe [1020304 2013-02-14] (ESET)
S3 ESHASRV; C:\Programme\ESET\ESET Endpoint Antivirus\EShaSrv.exe [183944 2013-02-14] (ESET)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2013-05-29] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2013-05-29] (Google Inc.)
S3 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2013-05-29] (Google)
S3 IDriverT; C:\Programme\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation)
S2 MBAMScheduler; C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2003-06-19] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
S3 WMZuneComm; c:\Programme\Zune\WMZuneComm.exe [268512 2011-08-05] (Microsoft Corporation)
R2 ZuneBusEnum; c:\Programme\Zune\ZuneBusEnum.exe [57056 2011-08-05] (Microsoft Corporation)
S3 ZuneNetworkSvc; c:\Programme\Zune\ZuneNss.exe [6363872 2011-08-05] (Microsoft Corporation)
S3 ZuneWlanCfgSvc; c:\Programme\Zune\ZuneWlanCfgSvc.exe [444640 2011-08-05] (Microsoft Corporation)
S2 AntiVirusKit Client; "C:\Programme\G Data\AVKClient\AVKCl.exe" [x]
R2 JavaQuickStarterService; "C:\Programme\Java\jre7\bin\jqs.exe" -service -config "C:\Programme\Java\jre7\lib\deploy\jqs\jqs.conf"
S3 stllssvr; "C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe" [x]
==================== Drivers (Whitelisted) ====================
S3 cpudrv; C:\Programme\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
R1 eamon; C:\Windows\System32\DRIVERS\eamon.sys [164488 2013-02-04] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [124848 2013-02-04] (ESET)
R1 epfwtdir; C:\Windows\System32\DRIVERS\epfwtdir.sys [107856 2013-02-04] (ESET)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R2 zumbus; C:\Windows\System32\DRIVERS\zumbus.sys [41472 2011-08-05] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\ADMINI~1.SCH\LOKALE~1\Temp\catchme.sys [x]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-10 23:37 - 2013-11-09 10:34 - 01089445 _____ (Farbar) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\FRST.exe
2013-11-10 23:33 - 2013-11-10 19:45 - 00891167 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\SecurityCheck.exe
2013-11-10 10:29 - 2013-11-10 10:29 - 00011049 _____ C:\WINDOWS\KB2862335.log
2013-11-10 10:29 - 2013-11-10 10:29 - 00010454 _____ C:\WINDOWS\KB2834904-v2.log
2013-11-10 10:29 - 2013-11-10 10:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$
2013-11-10 10:29 - 2013-11-10 10:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$
2013-11-10 10:29 - 2013-11-10 10:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-11-10 10:28 - 2013-11-10 10:28 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-11-10 10:28 - 2013-11-10 10:28 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-11-10 10:25 - 2013-11-10 10:28 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-11-10 10:22 - 2013-11-10 10:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868038$
2013-11-10 10:22 - 2013-11-10 10:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-11-10 10:22 - 2013-11-10 10:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-11-10 10:21 - 2013-11-10 10:22 - 00011817 _____ C:\WINDOWS\KB2868038.log
2013-11-10 10:20 - 2013-11-10 10:21 - 00009979 _____ C:\WINDOWS\KB2863058.log
2013-11-10 10:20 - 2013-11-10 10:20 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-11-10 10:20 - 2013-11-10 10:20 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-11-10 10:19 - 2013-11-10 10:20 - 00011523 _____ C:\WINDOWS\KB2879017-IE8.log
2013-11-10 10:18 - 2013-11-10 10:18 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2883150$
2013-11-10 10:18 - 2013-11-10 10:18 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$
2013-11-10 09:54 - 2013-11-10 09:54 - 00000736 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\JRT.txt
2013-11-10 09:43 - 2013-11-10 09:43 - 00000000 ____D C:\WINDOWS\ERUNT
2013-11-10 09:30 - 2013-11-10 09:37 - 00000000 ____D C:\AdwCleaner
2013-11-10 09:18 - 2013-11-10 10:29 - 00015432 _____ C:\WINDOWS\KB2847311.log
2013-11-10 09:18 - 2013-11-10 10:29 - 00014952 _____ C:\WINDOWS\KB2876217.log
2013-11-10 09:18 - 2013-07-03 03:12 - 00025088 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidparse.sys
2013-11-10 09:18 - 2013-07-03 02:59 - 00014976 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbscan.sys
2013-11-10 09:17 - 2013-11-10 10:28 - 00014118 _____ C:\WINDOWS\KB2864063.log
2013-11-10 09:17 - 2013-11-10 10:23 - 00014111 _____ C:\WINDOWS\KB2850869.log
2013-11-10 09:16 - 2013-11-10 10:22 - 00015857 _____ C:\WINDOWS\KB2859537.log
2013-11-10 09:16 - 2013-07-17 01:58 - 00123008 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbvideo.sys
2013-11-10 09:16 - 2013-07-17 01:58 - 00060160 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbaudio.sys
2013-11-10 09:16 - 2013-07-17 01:58 - 00046848 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\irbus.sys
2013-11-10 09:15 - 2013-08-09 01:55 - 00144128 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbport.sys
2013-11-10 09:15 - 2013-08-09 01:55 - 00005376 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbd.sys
2013-11-10 09:15 - 2009-03-18 12:02 - 00030336 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbehci.sys
2013-11-10 08:54 - 2013-11-10 08:54 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.*****\Anwendungsdaten\Malwarebytes
2013-11-10 08:53 - 2013-11-10 08:56 - 00000756 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-10 08:53 - 2013-11-10 08:56 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
2013-11-10 08:52 - 2013-11-10 08:56 - 00000000 ____D C:\Programme\Malwarebytes' Anti-Malware
2013-11-10 08:52 - 2013-11-10 08:52 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2013-11-10 08:52 - 2013-11-10 08:46 - 01073262 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\adwcleaner.exe
2013-11-10 08:52 - 2013-11-10 08:46 - 01034531 _____ (Thisisu) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\JRT.exe
2013-11-10 08:52 - 2013-11-10 08:45 - 10285040 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-10 08:52 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-11-09 19:04 - 2013-11-09 19:04 - 00013157 _____ C:\ComboFix.txt
2013-11-09 18:48 - 2013-11-09 18:48 - 00000000 _RSHD C:\cmdcons
2013-11-09 18:48 - 2013-04-26 08:33 - 00000211 _____ C:\Boot.bak
2013-11-09 18:48 - 2004-08-03 23:00 - 00262448 __RSH C:\cmldr
2013-11-09 18:42 - 2011-06-26 07:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-11-09 18:42 - 2010-11-07 18:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-11-09 18:42 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-11-09 18:42 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-11-09 18:42 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-11-09 18:42 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-11-09 18:42 - 2000-08-31 01:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-11-09 18:42 - 2000-08-31 01:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-11-09 18:42 - 2000-08-31 01:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-11-09 18:41 - 2013-11-09 19:04 - 00000000 ____D C:\Qoobox
2013-11-09 18:41 - 2013-11-09 19:02 - 00000000 ____D C:\WINDOWS\erdnt
2013-11-09 18:40 - 2013-11-09 18:34 - 05145633 ____R (Swearware) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\ComboFix.exe
2013-11-09 11:18 - 2013-11-09 11:18 - 00003994 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Gmer.txt
2013-11-09 10:52 - 2013-11-09 10:52 - 00020581 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Addition.txt
2013-11-09 10:51 - 2013-11-09 10:51 - 00000000 ____D C:\FRST
2013-11-09 10:50 - 2013-11-09 10:50 - 00000488 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\defogger_disable.log
2013-11-09 10:50 - 2013-11-09 10:50 - 00000000 _____ C:\Dokumente und Einstellungen\Administrator.*****\defogger_reenable
2013-11-09 10:49 - 2013-11-09 10:35 - 00377856 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\gmer_2.1.19163.exe
2013-11-09 10:49 - 2013-11-09 10:34 - 00050477 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Defogger.exe
2013-11-09 10:45 - 2008-04-14 07:52 - 00021504 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidserv.dll
2013-11-09 10:45 - 2008-04-14 07:52 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\system32\hidserv.dll
2013-11-09 10:45 - 2008-04-14 07:28 - 00014720 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\kbdhid.sys
2013-11-09 10:45 - 2008-04-14 07:28 - 00014720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys
2013-11-09 10:45 - 2008-04-14 00:15 - 00010368 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidusb.sys
2013-11-09 10:45 - 2008-04-14 00:15 - 00010368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys
2013-11-09 10:45 - 2001-08-18 04:22 - 00012288 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mouhid.sys
2013-11-09 10:45 - 2001-08-18 04:22 - 00012288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouhid.sys
2013-11-09 10:39 - 2013-11-09 10:40 - 00000000 ____D C:\avira-bericht
==================== One Month Modified Files and Folders =======
2013-11-10 23:38 - 2010-06-16 11:38 - 00000434 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{C2D09CAE-DD8A-494D-BC6D-D212D87EB7E0}.job
2013-11-10 23:36 - 2010-06-15 20:45 - 00000416 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{54E0F475-FC8F-4832-8C7B-C968408F4E48}.job
2013-11-10 23:36 - 2010-06-15 19:15 - 01903936 _____ C:\WINDOWS\WindowsUpdate.log
2013-11-10 23:28 - 2013-05-29 13:02 - 00001104 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-10 23:08 - 2010-06-15 19:04 - 00032492 _____ C:\WINDOWS\SchedLgU.Txt
2013-11-10 23:04 - 2013-05-29 13:01 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-11-10 20:14 - 2010-06-16 13:17 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-11-10 19:55 - 2013-08-06 11:01 - 00000000 ____D C:\Programme\ESET
2013-11-10 19:50 - 2013-03-22 09:39 - 00000000 ____D C:\Klicktel
2013-11-10 19:49 - 2013-05-29 13:02 - 00001100 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-10 19:49 - 2002-08-29 13:00 - 00012598 _____ C:\WINDOWS\system32\wpa.dbl
2013-11-10 19:46 - 2010-06-15 19:53 - 00414264 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-11-10 19:46 - 2010-06-15 19:00 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-11-10 19:45 - 2013-11-10 23:33 - 00891167 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\SecurityCheck.exe
2013-11-10 10:33 - 2010-06-15 19:54 - 01006656 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-11-10 10:29 - 2013-11-10 10:29 - 00011049 _____ C:\WINDOWS\KB2862335.log
2013-11-10 10:29 - 2013-11-10 10:29 - 00010454 _____ C:\WINDOWS\KB2834904-v2.log
2013-11-10 10:29 - 2013-11-10 10:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$
2013-11-10 10:29 - 2013-11-10 10:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$
2013-11-10 10:29 - 2013-11-10 10:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-11-10 10:29 - 2013-11-10 09:18 - 00015432 _____ C:\WINDOWS\KB2847311.log
2013-11-10 10:29 - 2013-11-10 09:18 - 00014952 _____ C:\WINDOWS\KB2876217.log
2013-11-10 10:29 - 2013-04-25 18:06 - 00496622 _____ C:\WINDOWS\setupapi.log
2013-11-10 10:29 - 2010-06-15 19:54 - 01813416 _____ C:\WINDOWS\FaxSetup.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00905338 _____ C:\WINDOWS\ocgen.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00842480 _____ C:\WINDOWS\tsoc.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00630858 _____ C:\WINDOWS\comsetup.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00580236 _____ C:\WINDOWS\msmqinst.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00380537 _____ C:\WINDOWS\ntdtcsetup.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00318675 _____ C:\WINDOWS\netfxocm.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00101405 _____ C:\WINDOWS\ocmsn.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00094779 _____ C:\WINDOWS\iis6.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00092676 _____ C:\WINDOWS\tabletoc.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00091815 _____ C:\WINDOWS\msgsocm.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00001393 _____ C:\WINDOWS\imsins.log
2013-11-10 10:29 - 2010-06-15 19:54 - 00001393 _____ C:\WINDOWS\imsins.BAK
2013-11-10 10:29 - 2010-06-15 19:09 - 00343243 _____ C:\WINDOWS\updspapi.log
2013-11-10 10:29 - 2010-06-15 19:08 - 00127058 _____ C:\WINDOWS\medctroc.Log
2013-11-10 10:28 - 2013-11-10 10:28 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-11-10 10:28 - 2013-11-10 10:28 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-11-10 10:28 - 2013-11-10 10:25 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-11-10 10:28 - 2013-11-10 09:17 - 00014118 _____ C:\WINDOWS\KB2864063.log
2013-11-10 10:23 - 2013-11-10 09:17 - 00014111 _____ C:\WINDOWS\KB2850869.log
2013-11-10 10:22 - 2013-11-10 10:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868038$
2013-11-10 10:22 - 2013-11-10 10:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-11-10 10:22 - 2013-11-10 10:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-11-10 10:22 - 2013-11-10 10:21 - 00011817 _____ C:\WINDOWS\KB2868038.log
2013-11-10 10:22 - 2013-11-10 09:16 - 00015857 _____ C:\WINDOWS\KB2859537.log
2013-11-10 10:21 - 2013-11-10 10:20 - 00009979 _____ C:\WINDOWS\KB2863058.log
2013-11-10 10:21 - 2010-06-15 20:36 - 00040844 _____ C:\WINDOWS\system32\TZLog.log
2013-11-10 10:20 - 2013-11-10 10:20 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-11-10 10:20 - 2013-11-10 10:20 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-11-10 10:20 - 2013-11-10 10:19 - 00011523 _____ C:\WINDOWS\KB2879017-IE8.log
2013-11-10 10:18 - 2013-11-10 10:18 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2883150$
2013-11-10 10:18 - 2013-11-10 10:18 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$
2013-11-10 10:10 - 2010-06-16 10:55 - 00000300 ___SH C:\Dokumente und Einstellungen\Administrator.*****\ntuser.ini
2013-11-10 09:54 - 2013-11-10 09:54 - 00000736 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\JRT.txt
2013-11-10 09:43 - 2013-11-10 09:43 - 00000000 ____D C:\WINDOWS\ERUNT
2013-11-10 09:37 - 2013-11-10 09:30 - 00000000 ____D C:\AdwCleaner
2013-11-10 09:36 - 2010-06-15 19:54 - 00000000 ___RD C:\Programme
2013-11-10 09:25 - 2013-07-10 16:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834886$
2013-11-10 08:56 - 2013-11-10 08:53 - 00000756 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-10 08:56 - 2013-11-10 08:53 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
2013-11-10 08:56 - 2013-11-10 08:52 - 00000000 ____D C:\Programme\Malwarebytes' Anti-Malware
2013-11-10 08:54 - 2013-11-10 08:54 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.*****\Anwendungsdaten\Malwarebytes
2013-11-10 08:53 - 2010-06-15 19:54 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2013-11-10 08:52 - 2013-11-10 08:52 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2013-11-10 08:46 - 2013-11-10 08:52 - 01073262 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\adwcleaner.exe
2013-11-10 08:46 - 2013-11-10 08:52 - 01034531 _____ (Thisisu) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\JRT.exe
2013-11-10 08:45 - 2013-11-10 08:52 - 10285040 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-09 19:04 - 2013-11-09 19:04 - 00013157 _____ C:\ComboFix.txt
2013-11-09 19:04 - 2013-11-09 18:41 - 00000000 ____D C:\Qoobox
2013-11-09 19:03 - 2010-06-16 10:55 - 00000000 ___RD C:\Dokumente und Einstellungen\Administrator.*****\Startmenü\Programme\Autostart
2013-11-09 19:02 - 2013-11-09 18:41 - 00000000 ____D C:\WINDOWS\erdnt
2013-11-09 19:02 - 2002-08-29 13:00 - 00000227 _____ C:\WINDOWS\system.ini
2013-11-09 18:57 - 2010-06-16 10:55 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.*****
2013-11-09 18:48 - 2013-11-09 18:48 - 00000000 _RSHD C:\cmdcons
2013-11-09 18:48 - 2010-06-15 20:53 - 00000327 __RSH C:\boot.ini
2013-11-09 18:34 - 2013-11-09 18:40 - 05145633 ____R (Swearware) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\ComboFix.exe
2013-11-09 11:18 - 2013-11-09 11:18 - 00003994 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Gmer.txt
2013-11-09 10:52 - 2013-11-09 10:52 - 00020581 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Addition.txt
2013-11-09 10:51 - 2013-11-09 10:51 - 00000000 ____D C:\FRST
2013-11-09 10:50 - 2013-11-09 10:50 - 00000488 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\defogger_disable.log
2013-11-09 10:50 - 2013-11-09 10:50 - 00000000 _____ C:\Dokumente und Einstellungen\Administrator.*****\defogger_reenable
2013-11-09 10:45 - 2010-06-15 19:53 - 00291367 _____ C:\WINDOWS\setupact.log
2013-11-09 10:40 - 2013-11-09 10:39 - 00000000 ____D C:\avira-bericht
2013-11-09 10:35 - 2013-11-09 10:49 - 00377856 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\gmer_2.1.19163.exe
2013-11-09 10:34 - 2013-11-10 23:37 - 01089445 _____ (Farbar) C:\Dokumente und Einstellungen\Administrator.*****\Desktop\FRST.exe
2013-11-09 10:34 - 2013-11-09 10:49 - 00050477 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Defogger.exe
2013-11-08 13:42 - 2010-06-16 11:08 - 00002509 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Microsoft Office Word 2003.lnk
2013-11-08 09:09 - 2012-08-10 12:20 - 00000015 _____ C:\WINDOWS\DatabaseID
2013-11-07 10:21 - 2010-06-16 11:08 - 00002537 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Microsoft Office Excel 2003.lnk
2013-11-06 14:32 - 2010-06-16 11:08 - 00002607 _____ C:\Dokumente und Einstellungen\Administrator.*****\Desktop\Microsoft Office Outlook 2003.lnk
2013-11-04 13:08 - 2013-05-29 13:03 - 00001777 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
2013-10-17 11:00 - 2013-03-13 07:53 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-10-17 11:00 - 2011-09-07 07:07 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-10-17 11:00 - 2010-06-16 13:05 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.*****\Lokale Einstellungen\Anwendungsdaten\Adobe
2013-10-16 15:43 - 2013-03-21 14:03 - 00000098 _____ C:\WINDOWS\ktel.ini
Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Administrator.*****\Lokale Einstellungen\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2002-08-29 13:00] - [2008-04-14 06:52] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e
C:\Windows\System32\winlogon.exe
[2002-08-29 13:00] - [2008-04-14 06:53] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a
C:\Windows\System32\svchost.exe
[2002-08-29 13:00] - [2008-04-14 06:53] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366
C:\Windows\System32\services.exe
[2002-08-29 13:00] - [2009-02-09 12:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc
C:\Windows\System32\User32.dll
[2002-08-29 13:00] - [2008-04-14 06:52] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd
C:\Windows\System32\userinit.exe
[2002-08-29 13:00] - [2008-04-14 06:53] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106
C:\Windows\System32\Drivers\volsnap.sys
[2002-08-29 13:00] - [2008-04-14 06:22] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d
==================== End Of Log ============================
--- --- --- [/CODE] Gruß Yeti
__________________ |
![]() |
| Themen zu Verdacht auf Spamversand - Avira Boot CD meldet 3 Funde |
| adobe, adware/installcore.e, antivirus, computer, e-mail, excel, explorer, farbar, farbar recovery scan tool, flash player, helper, homepage, icreinstall, iexplore.exe, java/lamar.dhg.2, pdfforge toolbar, plug-in, programme, pup.optional.opencandy, pup.optional.pcperformer.a, pup.optional.regcleanerpro, pup.optional.regcleanerpro.a, realtek, regclean, richtlinie, software, tr/inject.fzcg, trojan.agent.gen, windows, windows xp |