| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojan.Agent und Backdoor.Agent eingefangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
20.11.2013, 14:40
| #1 | |
| /// TB-Ausbilder   |  Trojan.Agent und Backdoor.Agent eingefangen Hi, Zitat:
 Schritt 1 Scan mit Combofix
Schritt 2 Starte noch einmal FRST.
__________________ cheers, Leo |
|
20.11.2013, 22:20
| #2 | |
 | Trojan.Agent und Backdoor.Agent eingefangen Hi aharonov,
__________________ Zitat:
 Bin jetzt aber soweit wider fertig mit allen, gab jetzt nur eine kleine Komplikation am Anfang bei Combofix, kurz bevor Combofix fertig wurde ist der Bildschirm ausgegangen, wegen der Energiespareinstellung und ich musste danach den Rechner ausmachen weil Combofix dadurch irgendwie stehen geblieben ist und dann auch außer der DOS box von Cf und den Desktop Hintergrund nix mehr zu sehen war. Nehme mal an es lag daran und auch wegen Windows weil es da nebenbei klammheimlich im Hintergrund das Service Pack aufgestockt hat, was mir dann beim anmachen erst auffiel, weil Windows meinte es müsste jetzt die Einstellung für das neue Service Pack vornehmen. Hab aber, dann nochmal nach den Start von Windows Combofix nochmal durch laufen lassen und da ging dann alles gut. Und hier sind jetzt auch erst mal die Logs von Cf und FRST: Code:
ATTFilter ComboFix 13-11-19.01 - Gutierrez 20.11.2013 18:52:43.2.2 - x86
ausgeführt von:: c:\users\Gutierrez\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\users\Gutierrez\AppData\Roaming\.#
c:\windows\system32\FlashPlayerApp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-20 bis 2013-11-20 ))))))))))))))))))))))))))))))
.
.
2013-11-20 18:06 . 2013-11-20 18:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-20 17:46 . 2013-11-20 17:46 40392 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{722949FB-57ED-479F-A7D6-1A34AF148A34}\MpKsl09524f80.sys
2013-11-20 17:22 . 2013-11-20 18:06 -------- d-----w- c:\users\Gutierrez\AppData\Local\temp
2013-11-20 16:37 . 2013-11-20 16:37 -------- d-----w- c:\windows\system32\SPReview
2013-11-19 22:14 . 2013-11-08 01:15 7772552 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{722949FB-57ED-479F-A7D6-1A34AF148A34}\mpengine.dll
2013-11-19 22:06 . 2013-11-19 22:06 -------- d-----w- C:\FRST
2013-11-19 12:24 . 2013-11-19 12:24 -------- d-----w- c:\windows\Temp3120495A-AC7C-C681-1FA1-F58FDF752975-Signatures
2013-11-18 23:20 . 2013-11-18 23:20 -------- d-----w- c:\windows\Temp891996F2-C0D5-ECE9-AD3F-F882AFAF36B1-Signatures
2013-11-16 22:15 . 2013-11-16 22:15 -------- d-----w- c:\users\Gutierrez\AppData\Roaming\Malwarebytes
2013-11-16 22:14 . 2013-11-16 22:14 -------- d-----w- c:\programdata\Malwarebytes
2013-11-16 22:14 . 2013-11-16 22:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-11-16 22:14 . 2013-04-04 13:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-11-16 22:14 . 2013-11-16 22:14 -------- d-----w- c:\users\Gutierrez\AppData\Local\Programs
2013-11-16 21:51 . 2013-10-14 06:39 7796464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-11-16 14:25 . 2013-11-16 14:27 -------- d-----w- c:\users\Administrator
2013-11-16 13:01 . 2009-07-14 01:14 270336 ----a-w- c:\windows\system32\sethc.exe
2013-11-09 00:34 . 2013-10-18 21:57 719224 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E3BCE28C-030B-4AE2-B651-B31EC50DC963}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 10:21 . 2012-04-30 08:02 230048 ------w- c:\windows\system32\MpSigStub.exe
2013-10-18 21:57 . 2012-06-12 16:15 719224 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-10-11 21:29 . 2011-07-14 11:30 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-27 08:53 . 2013-09-27 08:53 214696 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-09-27 08:53 . 2012-03-20 18:44 104768 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\Gutierrez\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-02-21 1103768]
"Facebook Update"="c:\users\Gutierrez\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-11-05 138096]
"Spotify"="c:\users\Gutierrez\AppData\Roaming\Spotify\Spotify.exe" [2013-02-21 4484504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-14 1541416]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-21 7625248]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-11-20 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-09-23 17:30 173592 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-09-23 17:30 141848 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-11-10 00:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-09-23 17:30 150552 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2009-02-25 12:40 218408 ------w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
.
S1 MpKsl09524f80;MpKsl09524f80;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{722949FB-57ED-479F-A7D6-1A34AF148A34}\MpKsl09524f80.sys [2013-11-20 40392]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 104768]
S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2013-10-23 280288]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-31 187392]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSL09524F80
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-27 21:29]
.
2013-11-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1675562717-242507097-1823633445-1000Core.job
- c:\users\Gutierrez\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-05 20:46]
.
2013-11-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1675562717-242507097-1823633445-1000UA.job
- c:\users\Gutierrez\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-05 20:46]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Gutierrez\AppData\Roaming\Mozilla\Firefox\Profiles\wahtq3ce.default\
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1675562717-242507097-1823633445-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1675562717-242507097-1823633445-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-11-20 19:11:21
ComboFix-quarantined-files.txt 2013-11-20 18:11
.
Vor Suchlauf: 13 Verzeichnis(se), 39.389.175.808 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 39.204.438.016 Bytes frei
.
- - End Of File - - 9A8BC9DEC98AEA5AC445CE9E966A7936
2E5DEBB2116B3417023E0D6562D7ED07
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013
Ran by Gutierrez (administrator) on MARCOSOYER on 20-11-2013 19:29:57
Running from C:\Users\Gutierrez\Desktop
Microsoft Windows 7 Starter (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
() C:\windows\SYSTEM32\Rezip.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\windows\system32\wuauclt.exe
(Intel Corporation) C:\windows\system32\igfxsrvc.exe
(Microsoft Corporation) \\?\C:\windows\system32\wbem\WMIADAP.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1541416 2009-07-15] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-21] (Realtek Semiconductor)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Gutierrez\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1103768 2013-02-21] (Spotify Ltd)
HKCU\...\Run: [Facebook Update] - C:\Users\Gutierrez\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-11-05] (Facebook Inc.)
HKCU\...\Run: [Spotify] - C:\Users\Gutierrez\AppData\Roaming\Spotify\spotify.exe [4484504 2013-02-21] (Spotify Ltd)
Startup: C:\Users\Gutierrez\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Gutierrez\AppData\Roaming\Mozilla\Firefox\Profiles\wahtq3ce.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Gutierrez\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
========================== Services (Whitelisted) =================
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] ()
==================== Drivers (Whitelisted) ====================
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R1 MpKsl09524f80; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{722949FB-57ED-479F-A7D6-1A34AF148A34}\MpKsl09524f80.sys [40392 2013-11-20] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R3 catchme; \??\C:\Users\GUTIER~1\AppData\Local\Temp\catchme.sys [x]
U3 mbr; \??\C:\ComboFix\mbr.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-20 19:29 - 2013-11-20 19:29 - 00005488 _____ C:\Users\Gutierrez\Desktop\FRST.txt
2013-11-20 19:11 - 2013-11-20 19:11 - 00008352 _____ C:\ComboFix.txt
2013-11-20 17:40 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2013-11-20 17:40 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2013-11-20 17:40 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-11-20 17:40 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-11-20 17:40 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-11-20 17:40 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2013-11-20 17:40 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2013-11-20 17:40 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2013-11-20 17:39 - 2013-11-20 19:11 - 00000000 ____D C:\Qoobox
2013-11-20 17:38 - 2013-11-20 18:27 - 00000000 ____D C:\windows\erdnt
2013-11-20 17:37 - 2013-11-20 17:37 - 00000000 ____D C:\windows\system32\SPReview
2013-11-20 17:34 - 2013-11-20 17:26 - 05146522 ____R (Swearware) C:\Users\Gutierrez\Desktop\ComboFix.exe
2013-11-19 23:06 - 2013-11-19 23:06 - 00000000 ____D C:\FRST
2013-11-19 23:05 - 2013-11-19 23:06 - 01090881 _____ (Farbar) C:\Users\Gutierrez\Desktop\FRST.exe
2013-11-19 13:24 - 2013-11-19 13:24 - 00000000 ____D C:\windows\Temp3120495A-AC7C-C681-1FA1-F58FDF752975-Signatures
2013-11-19 00:20 - 2013-11-19 00:20 - 00000000 ____D C:\windows\Temp891996F2-C0D5-ECE9-AD3F-F882AFAF36B1-Signatures
2013-11-19 00:10 - 2013-11-19 00:10 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{04AC35A6-FC9E-4DCF-94BC-0F9D75D897B5}
2013-11-17 01:53 - 2013-11-17 01:53 - 00068312 _____ C:\Users\Gutierrez\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-17 01:52 - 2013-11-20 18:32 - 00003190 _____ C:\windows\PFRO.log
2013-11-17 01:52 - 2013-11-17 01:52 - 00302408 _____ C:\windows\system32\FNTCACHE.DAT
2013-11-17 01:00 - 2013-11-20 18:42 - 00000392 _____ C:\windows\setupact.log
2013-11-17 01:00 - 2013-11-17 01:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-16 23:15 - 2013-11-16 23:15 - 00000000 ____D C:\Users\Gutierrez\AppData\Roaming\Malwarebytes
2013-11-16 23:14 - 2013-11-16 23:14 - 00001194 _____ C:\Users\Gutierrez\Desktop\Mozilla Firefox.lnk
2013-11-16 23:14 - 2013-11-16 23:14 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-16 23:14 - 2013-11-16 23:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-16 23:14 - 2013-11-16 23:14 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-16 23:14 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-11-16 23:09 - 2013-11-16 23:10 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{64C1D2D3-5A52-4F9C-80C7-61988A0F3380}
2013-11-16 22:31 - 2013-11-16 22:31 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{0F267F6F-6CFC-4219-B39C-7345FC62395B}
2013-11-16 22:24 - 2013-11-16 22:24 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{C5B23043-3C63-4D47-AF21-C8BAB895C9C1}
2013-11-16 20:33 - 2013-11-16 20:33 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{17F70D3D-B932-4100-9C71-0AFCA5517273}
2013-11-16 20:29 - 2013-11-16 20:29 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{19ACB9F6-981C-4997-9103-D1EB30564F40}
2013-11-16 20:27 - 2013-11-16 20:27 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{3A962857-CAC2-4C62-BCF1-3FB8A8C0ADD2}
2013-11-16 17:17 - 2013-11-16 17:17 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{0D9DEDD9-4BB6-43A3-AAC8-09F471299EF6}
2013-11-16 15:55 - 2013-11-16 15:55 - 00068312 _____ C:\Users\Administrator.MARCOSOYER.000\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-16 15:52 - 2013-11-16 15:52 - 00001409 _____ C:\Users\Administrator.MARCOSOYER.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-16 15:31 - 2013-11-16 15:40 - 00000000 ____D C:\Users\Administrator.MARCOSOYER.000
2013-11-16 15:31 - 2013-11-16 15:31 - 00000020 ___SH C:\Users\Administrator.MARCOSOYER.000\ntuser.ini
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Startmenü
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Netzwerkumgebung
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Druckumgebung
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Documents\Eigene Musik
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Documents\Eigene Bilder
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\AppData\Local\Verlauf
2013-11-16 15:31 - 2011-05-13 06:14 - 00000000 ____D C:\Users\Administrator.MARCOSOYER.000\AppData\Local\Microsoft Help
2013-11-16 15:31 - 2011-04-24 08:47 - 00001093 _____ C:\Users\Administrator.MARCOSOYER.000\Desktop\CyberLink YouCam.lnk
2013-11-16 15:31 - 2011-04-24 08:47 - 00000000 ____D C:\Users\Administrator.MARCOSOYER.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam
2013-11-16 15:31 - 2009-07-14 05:42 - 00000000 ___RD C:\Users\Administrator.MARCOSOYER.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-16 15:31 - 2009-07-14 05:37 - 00000000 ___RD C:\Users\Administrator.MARCOSOYER.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-16 15:28 - 2013-11-16 15:28 - 00000020 ___SH C:\Users\Administrator.MARCOSOYER\ntuser.ini
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Startmenü
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Netzwerkumgebung
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Druckumgebung
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Documents\Eigene Musik
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Documents\Eigene Bilder
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\AppData\Local\Verlauf
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 ____D C:\Users\Administrator.MARCOSOYER
2013-11-16 15:28 - 2011-05-13 06:14 - 00000000 ____D C:\Users\Administrator.MARCOSOYER\AppData\Local\Microsoft Help
2013-11-16 15:28 - 2011-04-24 08:47 - 00001093 _____ C:\Users\Administrator.MARCOSOYER\Desktop\CyberLink YouCam.lnk
2013-11-16 15:28 - 2011-04-24 08:47 - 00000000 ____D C:\Users\Administrator.MARCOSOYER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam
2013-11-16 15:28 - 2009-07-14 05:42 - 00000000 ___RD C:\Users\Administrator.MARCOSOYER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-16 15:28 - 2009-07-14 05:37 - 00000000 ___RD C:\Users\Administrator.MARCOSOYER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-16 15:25 - 2013-11-16 15:27 - 00000000 ____D C:\Users\Administrator
2013-11-16 15:25 - 2013-11-16 15:25 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Startmenü
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2013-11-16 15:25 - 2011-05-13 06:14 - 00000000 ____D C:\Users\Administrator\AppData\Local\Microsoft Help
2013-11-16 15:25 - 2011-04-24 08:47 - 00001093 _____ C:\Users\Administrator\Desktop\CyberLink YouCam.lnk
2013-11-16 15:25 - 2011-04-24 08:47 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam
2013-11-16 15:25 - 2009-07-14 05:42 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-16 15:25 - 2009-07-14 05:37 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-16 15:16 - 2013-11-16 15:16 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{B0A568A2-AF50-49D2-AA96-5E4C60552F9F}
2013-11-16 15:10 - 2013-11-16 15:10 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{67B3C174-99C8-4E03-A3F1-A68A926DA3BF}
2013-11-16 15:05 - 2013-11-16 15:05 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{35C96CF2-5345-40A6-9B26-0AE1502C6F3E}
2013-11-16 15:01 - 2013-11-16 15:01 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{4E8D51F2-1E46-44BF-A399-99C9C9B018E9}
2013-11-16 14:01 - 2009-07-14 02:14 - 00270336 _____ (Microsoft Corporation) C:\windows\system32\sethc.exe
2013-11-10 12:37 - 2013-11-10 12:37 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{0BE99D19-1FA5-42C8-A3A0-EFEEE9AA7078}
2013-11-09 01:15 - 2013-11-09 01:15 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{CD93B7DF-07B0-463E-85FD-1E75DFDF7217}
2013-11-08 01:01 - 2013-11-08 01:01 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{92FA21FD-AEC7-4896-BD3E-1590B8E8039D}
2013-10-25 23:25 - 2013-10-25 23:26 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{5E859F85-6839-4299-918A-9CA53D73CC8C}
2013-10-25 10:18 - 2013-10-25 10:18 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{E3050AF1-F347-4EB1-8A5F-58CADA64A343}
2013-10-23 23:08 - 2013-10-23 23:08 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{6B29C0EA-8585-4646-A77D-DFBBACC998B2}
2013-10-22 14:24 - 2013-10-22 14:25 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{847A73E9-CE37-45D7-BF33-ACE49084CCB6}
2013-10-21 23:50 - 2013-10-21 23:50 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{585F7C52-EA60-447B-9297-AFA43CEF4EFE}
2013-10-21 08:12 - 2013-10-21 08:13 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{CEF11EA0-8F38-46A0-A4EE-A0763E3FFDAF}
==================== One Month Modified Files and Folders =======
2013-11-20 19:30 - 2013-11-20 19:29 - 00005488 _____ C:\Users\Gutierrez\Desktop\FRST.txt
2013-11-20 19:27 - 2013-03-27 13:51 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-20 19:11 - 2013-11-20 19:11 - 00008352 _____ C:\ComboFix.txt
2013-11-20 19:11 - 2013-11-20 17:39 - 00000000 ____D C:\Qoobox
2013-11-20 19:11 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default
2013-11-20 19:11 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2013-11-20 19:07 - 2009-07-14 03:04 - 00000215 _____ C:\windows\system.ini
2013-11-20 18:52 - 2012-11-05 21:47 - 00000944 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1675562717-242507097-1823633445-1000UA.job
2013-11-20 18:51 - 2009-07-14 05:34 - 00010272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-20 18:51 - 2009-07-14 05:34 - 00010272 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-20 18:47 - 2011-07-12 12:08 - 01434763 _____ C:\windows\WindowsUpdate.log
2013-11-20 18:44 - 2012-05-20 10:51 - 00000000 ____D C:\Users\Gutierrez\AppData\Roaming\Spotify
2013-11-20 18:42 - 2013-11-17 01:00 - 00000392 _____ C:\windows\setupact.log
2013-11-20 18:42 - 2009-07-14 05:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-20 18:32 - 2013-11-17 01:52 - 00003190 _____ C:\windows\PFRO.log
2013-11-20 18:27 - 2013-11-20 17:38 - 00000000 ____D C:\windows\erdnt
2013-11-20 17:37 - 2013-11-20 17:37 - 00000000 ____D C:\windows\system32\SPReview
2013-11-20 17:36 - 2009-07-26 21:06 - 01512182 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-20 17:34 - 2012-04-30 08:59 - 00001912 _____ C:\windows\epplauncher.mif
2013-11-20 17:33 - 2012-04-30 08:58 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-20 17:28 - 2013-09-17 21:40 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-20 17:26 - 2013-11-20 17:34 - 05146522 ____R (Swearware) C:\Users\Gutierrez\Desktop\ComboFix.exe
2013-11-19 23:06 - 2013-11-19 23:06 - 00000000 ____D C:\FRST
2013-11-19 23:06 - 2013-11-19 23:05 - 01090881 _____ (Farbar) C:\Users\Gutierrez\Desktop\FRST.exe
2013-11-19 13:24 - 2013-11-19 13:24 - 00000000 ____D C:\windows\Temp3120495A-AC7C-C681-1FA1-F58FDF752975-Signatures
2013-11-19 11:21 - 2012-04-30 09:02 - 00230048 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-11-19 00:20 - 2013-11-19 00:20 - 00000000 ____D C:\windows\Temp891996F2-C0D5-ECE9-AD3F-F882AFAF36B1-Signatures
2013-11-19 00:18 - 2009-07-14 03:37 - 00000000 ____D C:\windows\system32\LogFiles
2013-11-19 00:15 - 2011-04-24 08:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-19 00:10 - 2013-11-19 00:10 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{04AC35A6-FC9E-4DCF-94BC-0F9D75D897B5}
2013-11-19 00:09 - 2011-06-23 10:14 - 00000000 ____D C:\Users\Gutierrez\Tracing
2013-11-17 01:53 - 2013-11-17 01:53 - 00068312 _____ C:\Users\Gutierrez\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-17 01:52 - 2013-11-17 01:52 - 00302408 _____ C:\windows\system32\FNTCACHE.DAT
2013-11-17 01:52 - 2009-07-14 05:52 - 00000000 ____D C:\windows\twain_32
2013-11-17 01:00 - 2013-11-17 01:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-17 00:16 - 2012-02-18 08:40 - 00000000 __SHD C:\Users\Gutierrez\AppData\Local\7a5f2920
2013-11-16 23:37 - 2011-05-25 22:10 - 00000000 ____D C:\windows\Minidump
2013-11-16 23:37 - 2009-07-26 21:57 - 00000000 ____D C:\windows\Panther
2013-11-16 23:18 - 2011-04-24 11:31 - 00000965 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-16 23:18 - 2011-04-24 11:31 - 00000000 ____D C:\Program Files\CCleaner
2013-11-16 23:15 - 2013-11-16 23:15 - 00000000 ____D C:\Users\Gutierrez\AppData\Roaming\Malwarebytes
2013-11-16 23:14 - 2013-11-16 23:14 - 00001194 _____ C:\Users\Gutierrez\Desktop\Mozilla Firefox.lnk
2013-11-16 23:14 - 2013-11-16 23:14 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-16 23:14 - 2013-11-16 23:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-16 23:14 - 2013-11-16 23:14 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-16 23:10 - 2013-11-16 23:09 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{64C1D2D3-5A52-4F9C-80C7-61988A0F3380}
2013-11-16 23:07 - 2012-12-20 22:30 - 00000000 ____D C:\Program Files\McAfee
2013-11-16 23:07 - 2012-05-22 22:45 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-16 23:07 - 2009-08-27 09:54 - 00000000 ____D C:\Program Files\Common Files\McAfee
2013-11-16 23:07 - 2009-08-27 09:52 - 00000000 ____D C:\ProgramData\McAfee
2013-11-16 22:31 - 2013-11-16 22:31 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{0F267F6F-6CFC-4219-B39C-7345FC62395B}
2013-11-16 22:24 - 2013-11-16 22:24 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{C5B23043-3C63-4D47-AF21-C8BAB895C9C1}
2013-11-16 20:33 - 2013-11-16 20:33 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{17F70D3D-B932-4100-9C71-0AFCA5517273}
2013-11-16 20:29 - 2013-11-16 20:29 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{19ACB9F6-981C-4997-9103-D1EB30564F40}
2013-11-16 20:27 - 2013-11-16 20:27 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{3A962857-CAC2-4C62-BCF1-3FB8A8C0ADD2}
2013-11-16 17:17 - 2013-11-16 17:17 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{0D9DEDD9-4BB6-43A3-AAC8-09F471299EF6}
2013-11-16 15:55 - 2013-11-16 15:55 - 00068312 _____ C:\Users\Administrator.MARCOSOYER.000\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-16 15:52 - 2013-11-16 15:52 - 00001409 _____ C:\Users\Administrator.MARCOSOYER.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-16 15:40 - 2013-11-16 15:31 - 00000000 ____D C:\Users\Administrator.MARCOSOYER.000
2013-11-16 15:31 - 2013-11-16 15:31 - 00000020 ___SH C:\Users\Administrator.MARCOSOYER.000\ntuser.ini
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Startmenü
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Netzwerkumgebung
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Druckumgebung
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Documents\Eigene Musik
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\Documents\Eigene Bilder
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-16 15:31 - 2013-11-16 15:31 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER.000\AppData\Local\Verlauf
2013-11-16 15:28 - 2013-11-16 15:28 - 00000020 ___SH C:\Users\Administrator.MARCOSOYER\ntuser.ini
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Startmenü
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Netzwerkumgebung
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Druckumgebung
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Documents\Eigene Musik
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\Documents\Eigene Bilder
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 _SHDL C:\Users\Administrator.MARCOSOYER\AppData\Local\Verlauf
2013-11-16 15:28 - 2013-11-16 15:28 - 00000000 ____D C:\Users\Administrator.MARCOSOYER
2013-11-16 15:27 - 2013-11-16 15:25 - 00000000 ____D C:\Users\Administrator
2013-11-16 15:25 - 2013-11-16 15:25 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Startmenü
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-16 15:25 - 2013-11-16 15:25 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2013-11-16 15:16 - 2013-11-16 15:16 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{B0A568A2-AF50-49D2-AA96-5E4C60552F9F}
2013-11-16 15:10 - 2013-11-16 15:10 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{67B3C174-99C8-4E03-A3F1-A68A926DA3BF}
2013-11-16 15:05 - 2013-11-16 15:05 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{35C96CF2-5345-40A6-9B26-0AE1502C6F3E}
2013-11-16 15:01 - 2013-11-16 15:01 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{4E8D51F2-1E46-44BF-A399-99C9C9B018E9}
2013-11-14 12:08 - 2012-11-05 21:46 - 00000922 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1675562717-242507097-1823633445-1000Core.job
2013-11-10 12:37 - 2013-11-10 12:37 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{0BE99D19-1FA5-42C8-A3A0-EFEEE9AA7078}
2013-11-09 01:15 - 2013-11-09 01:15 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{CD93B7DF-07B0-463E-85FD-1E75DFDF7217}
2013-11-08 01:01 - 2013-11-08 01:01 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{92FA21FD-AEC7-4896-BD3E-1590B8E8039D}
2013-10-25 23:26 - 2013-10-25 23:25 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{5E859F85-6839-4299-918A-9CA53D73CC8C}
2013-10-25 10:18 - 2013-10-25 10:18 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{E3050AF1-F347-4EB1-8A5F-58CADA64A343}
2013-10-23 23:08 - 2013-10-23 23:08 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{6B29C0EA-8585-4646-A77D-DFBBACC998B2}
2013-10-22 14:25 - 2013-10-22 14:24 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{847A73E9-CE37-45D7-BF33-ACE49084CCB6}
2013-10-21 23:50 - 2013-10-21 23:50 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{585F7C52-EA60-447B-9297-AFA43CEF4EFE}
2013-10-21 08:13 - 2013-10-21 08:12 - 00000000 ____D C:\Users\Gutierrez\AppData\Local\{CEF11EA0-8F38-46A0-A4EE-A0763E3FFDAF}
ZeroAccess:
C:\Users\Gutierrez\AppData\Local\7a5f2920
C:\Users\Gutierrez\AppData\Local\7a5f2920\U\00000001.$
C:\Users\Gutierrez\AppData\Local\7a5f2920\U\000000c0.$
C:\Users\Gutierrez\AppData\Local\7a5f2920\U\000000cb.$
C:\Users\Gutierrez\AppData\Local\7a5f2920\U\80000000.$
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-19 23:43
==================== End Of Log ============================
Lg PsychoMantis |
|
| Themen zu Trojan.Agent und Backdoor.Agent eingefangen |
| administrator, adware, agent, anti-malware, autostart, backdoor, dateien, explorer, folge, gefährlich, gelöscht, laptop, logfile, malwarebytes, microsoft, neu, neu aufsetzten, scan, seite, software, system, system neu, trojan, trojan.agent, viren, windows |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
