Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Interpol-Trojaner, Win7

Interpol-Trojaner, Win7


Log-Analyse und Auswertung: Interpol-Trojaner, Win7

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 24.11.2013, 02:43   #1
blind310
 
Interpol-Trojaner, Win7 - Standard

Interpol-Trojaner, Win7


Hallo zusammen,

Ich habe seit 2 Wochen auf meinem alten Laptop den Interpol-Trojaner. Anfangs hat er nicht jedes Mal ausgeschlagen, aber inzwischen poppt der schon auf, sobald ich den Laptop hochgefahren habe und Internet-Verbindung besteht.
Ich habe bereits versucht, das System zurückzusetzen, hat aber aus irgendeinem Grund nicht funktioniert. Das System neu aufsetzen kann ich grade auch nicht, da ich die CD nicht finde.
Daher ist der Fix über FRST meine letzte wirkliche Hoffnung.
Den Scan habe ich schon gemacht, und hier ist das Ergebnis:

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2013 03
Ran by SYSTEM on MININT-PUQMUEE on 24-11-2013 02:34:55
Running from E:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [617856 2009-07-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [320000 2009-04-09] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [afgpi] - rundll32.exe "C:\Users\Christian\AppData\Roaming\afgpi.dll",HrGetStyleSheet <===== ATTENTION
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028896 2013-07-03] (NVIDIA Corporation)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [98304 2009-04-01] (ASUS)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [8493624 2009-07-07] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [159744 2009-04-20] (ASUS)
HKLM-x32\...\Run: [Setwallpaper] - c:\programdata\SetWallpaper.cmd
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPUsageTrackingLEDM] - C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-23] (APN)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Christian\...\Run: [Akamai NetSession Interface] - C:\Users\Christian\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-04] (Akamai Technologies, Inc.)
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9rjolfe3.lnk
ShortcutTarget: 9rjolfe3.lnk -> C:\PROGRA~3\3eflojr9.dss (Корпорация Майкрософт)
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-07] (Avira Operations GmbH & Co. KG)
S2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
S2 ASLDRService; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-13] ()
S2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-07] ()
S2 FastBootAgent; C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe [306232 2009-07-23] (ASUSTeK Computer Inc.)
S2 Winmgmt; C:\ProgramData\jeaa1v.pss [61028 2013-11-19] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] ()
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-12] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-12] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2010-10-13] (Marvell Semiconductor, Inc.)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 tmlwf; 
S3 tmwfp; 
S3 X6va005; \??\C:\Users\CHRIST~1\AppData\Local\Temp\0056309.tmp [x]
S3 X6va006; \??\C:\Users\CHRIST~1\AppData\Local\Temp\006FD98.tmp [x]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [x]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [x]
S3 X6va010; \??\C:\Windows\SysWOW64\Drivers\X6va010 [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-24 02:34 - 2013-11-24 02:34 - 00000000 ____D C:\FRST
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default\AppData\Local\Power2Go
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default User\AppData\Local\Power2Go
2013-11-22 00:55 - 2013-11-23 17:19 - 95025368 ____T C:\ProgramData\9rjolfe3.bxx
2013-11-22 00:55 - 2013-11-23 17:18 - 00000000 _____ C:\ProgramData\9rjolfe3.fvv
2013-11-22 00:55 - 2013-11-22 00:55 - 00208896 _____ (Корпорация Майкрософт) C:\ProgramData\3eflojr9.dss
2013-11-22 00:55 - 2013-11-22 00:55 - 00060516 ____T (Microsoft Corporation) C:\ProgramData\9rjolfe3.pss
2013-11-19 15:45 - 2013-11-19 15:45 - 00000273 _____ C:\ProgramData\jeaa1v.reg
2013-11-19 15:44 - 2013-11-20 14:36 - 95025368 ____T C:\ProgramData\jeaa1v.bxx
2013-11-19 15:44 - 2013-11-20 14:25 - 00000000 _____ C:\ProgramData\jeaa1v.fvv
2013-11-19 15:44 - 2013-11-19 15:44 - 00061028 ____T (Microsoft Corporation) C:\ProgramData\jeaa1v.pss
2013-11-14 16:09 - 2013-10-12 00:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-14 16:09 - 2013-10-12 00:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-14 16:09 - 2013-10-12 00:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-14 16:09 - 2013-10-12 00:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-14 16:09 - 2013-10-12 00:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-14 16:09 - 2013-10-11 23:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 16:09 - 2013-10-11 23:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 16:09 - 2013-10-11 23:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 16:09 - 2013-10-11 22:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-14 16:09 - 2013-10-11 22:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 16:09 - 2013-10-11 21:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-14 16:09 - 2013-10-11 21:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 10:50 - 2013-10-05 12:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-14 10:50 - 2013-10-05 11:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 10:50 - 2013-10-02 18:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-11-14 10:50 - 2013-10-02 18:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 10:50 - 2013-09-27 17:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2013-11-14 10:50 - 2013-09-24 18:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2013-11-14 10:50 - 2013-09-24 18:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-11-14 10:50 - 2013-09-24 18:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2013-11-14 10:50 - 2013-09-24 18:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2013-11-14 10:50 - 2013-09-24 18:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-11-14 10:50 - 2013-09-24 18:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-11-14 10:50 - 2013-09-24 18:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-11-14 10:50 - 2013-09-24 18:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-11-14 10:50 - 2013-09-24 17:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 10:50 - 2013-09-24 17:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 10:50 - 2013-09-24 17:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 10:50 - 2013-09-24 17:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 10:50 - 2013-09-24 17:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-11-14 10:50 - 2013-07-04 04:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2013-11-14 10:49 - 2013-10-11 18:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\System32\nshwfp.dll
2013-11-14 10:49 - 2013-10-11 18:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-14 10:49 - 2013-10-11 18:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-14 10:49 - 2013-10-11 18:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 10:49 - 2013-10-11 18:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 10:49 - 2013-10-03 18:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\System32\SmartcardCredentialProvider.dll
2013-11-14 10:49 - 2013-10-03 18:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\credui.dll
2013-11-14 10:49 - 2013-10-03 18:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-11-14 10:49 - 2013-10-03 17:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 10:49 - 2013-10-03 17:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 10:49 - 2013-10-03 17:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-01 03:56 - 2013-11-01 03:56 - 00000915 _____ C:\Users\UpdatusUser\Desktop\FlorensiaEN.lnk
2013-11-01 03:56 - 2013-11-01 03:56 - 00000915 _____ C:\Users\Christian\Desktop\FlorensiaEN.lnk
2013-11-01 03:47 - 2013-11-01 03:56 - 00000000 ____D C:\AHA Entertainment
2013-11-01 03:28 - 2013-11-01 03:43 - 1105972422 _____ C:\flo_setup_en_rs_130911.exe
2013-11-01 03:28 - 2013-11-01 03:28 - 00000000 ____D C:\ProgramData\Solid State Networks
2013-11-01 03:27 - 2013-11-01 03:27 - 01173504 _____ (ProSiebenSat.1 Games) C:\Users\Christian\Downloads\florensia-dlm.exe
2013-10-31 15:03 - 2013-10-31 15:03 - 00000000 ____D C:\ProgramData\Oracle
2013-10-31 15:02 - 2013-10-31 15:02 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-31 15:02 - 2013-10-31 15:02 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

==================== One Month Modified Files and Folders =======

2013-11-24 02:34 - 2013-11-24 02:34 - 00000000 ____D C:\FRST
2013-11-23 17:19 - 2013-11-22 00:55 - 95025368 ____T C:\ProgramData\9rjolfe3.bxx
2013-11-23 17:18 - 2013-11-22 00:55 - 00000000 _____ C:\ProgramData\9rjolfe3.fvv
2013-11-23 17:18 - 2009-09-29 05:39 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-23 17:18 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-23 17:18 - 2009-07-13 20:51 - 00119322 _____ C:\Windows\setupact.log
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default\AppData\Local\Power2Go
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-11-22 01:01 - 2013-11-22 01:01 - 00000000 ____D C:\Users\Default User\AppData\Local\Power2Go
2013-11-22 00:55 - 2013-11-22 00:55 - 00208896 _____ (Корпорация Майкрософт) C:\ProgramData\3eflojr9.dss
2013-11-22 00:55 - 2013-11-22 00:55 - 00060516 ____T (Microsoft Corporation) C:\ProgramData\9rjolfe3.pss
2013-11-22 00:53 - 2012-04-17 10:41 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-22 00:46 - 2009-07-13 20:45 - 00010016 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-22 00:46 - 2009-07-13 20:45 - 00010016 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-22 00:45 - 2009-09-29 04:44 - 01708200 _____ C:\Windows\WindowsUpdate.log
2013-11-20 14:36 - 2013-11-19 15:44 - 95025368 ____T C:\ProgramData\jeaa1v.bxx
2013-11-20 14:25 - 2013-11-19 15:44 - 00000000 _____ C:\ProgramData\jeaa1v.fvv
2013-11-19 16:41 - 2009-09-29 05:38 - 01304342 _____ C:\Windows\PFRO.log
2013-11-19 15:45 - 2013-11-19 15:45 - 00000273 _____ C:\ProgramData\jeaa1v.reg
2013-11-19 15:44 - 2013-11-19 15:44 - 00061028 ____T (Microsoft Corporation) C:\ProgramData\jeaa1v.pss
2013-11-19 11:13 - 2009-08-04 01:51 - 00700380 _____ C:\Windows\System32\perfh007.dat
2013-11-19 11:13 - 2009-08-04 01:51 - 00149144 _____ C:\Windows\System32\perfc007.dat
2013-11-19 11:13 - 2009-07-13 21:13 - 01621084 _____ C:\Windows\System32\PerfStringBackup.INI
2013-11-19 11:06 - 2012-04-17 10:41 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-19 11:06 - 2012-04-17 10:41 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-19 11:06 - 2012-01-18 11:48 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-19 11:06 - 2011-11-20 09:11 - 00000000 ____D C:\Users\Christian\AppData\Local\Adobe
2013-11-19 11:05 - 2011-11-20 07:38 - 00000000 ____D C:\Users\Christian\AppData\Roaming\Skype
2013-11-16 15:41 - 2012-05-05 14:54 - 00000000 ____D C:\Users\Christian\AppData\Local\PMB Files
2013-11-16 15:41 - 2012-05-05 14:54 - 00000000 ____D C:\ProgramData\PMB Files
2013-11-15 03:42 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-11-14 16:08 - 2013-08-02 03:48 - 00000000 ____D C:\Windows\System32\MRT
2013-11-14 16:05 - 2011-11-23 06:56 - 82896128 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-11-12 03:09 - 2013-08-08 06:09 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-11-12 03:09 - 2013-08-08 06:09 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-11-11 08:18 - 2011-11-20 07:38 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-11 08:18 - 2011-11-20 07:38 - 00000000 ____D C:\ProgramData\Skype
2013-11-01 04:19 - 2009-07-13 19:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-11-01 03:57 - 2013-11-01 03:28 - 00000000 ____D C:\ProgramData\Solid State Networks
2013-11-01 03:56 - 2013-11-01 03:56 - 00000915 _____ C:\Users\UpdatusUser\Desktop\FlorensiaEN.lnk
2013-11-01 03:56 - 2013-11-01 03:56 - 00000915 _____ C:\Users\Christian\Desktop\FlorensiaEN.lnk
2013-11-01 03:56 - 2013-11-01 03:47 - 00000000 ____D C:\AHA Entertainment
2013-11-01 03:43 - 2013-11-01 03:28 - 1105972422 _____ C:\flo_setup_en_rs_130911.exe
2013-11-01 03:27 - 2013-11-01 03:27 - 01173504 _____ (ProSiebenSat.1 Games) C:\Users\Christian\Downloads\florensia-dlm.exe
2013-10-31 15:03 - 2013-10-31 15:03 - 00000000 ____D C:\ProgramData\Oracle
2013-10-31 15:02 - 2013-10-31 15:02 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-31 15:02 - 2013-10-31 15:02 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-31 15:02 - 2013-06-20 00:40 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-31 15:02 - 2013-06-20 00:40 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-31 15:02 - 2011-11-29 06:49 - 00000000 ____D C:\Program Files (x86)\Java

Files to move or delete:
====================
C:\ProgramData\3eflojr9.dss
C:\ProgramData\9rjolfe3.bxx
C:\ProgramData\9rjolfe3.fvv
C:\ProgramData\9rjolfe3.pss
C:\ProgramData\jeaa1v.bxx
C:\ProgramData\jeaa1v.fvv
C:\ProgramData\jeaa1v.pss
C:\ProgramData\jeaa1v.reg
C:\ProgramData\pmt_0piot.pad


Some content of TEMP:
====================
C:\Users\Christian\AppData\Local\Temp\0259.dll
C:\Users\Christian\AppData\Local\Temp\0547.dll
C:\Users\Christian\AppData\Local\Temp\8liik-wu.dll
C:\Users\Christian\AppData\Local\Temp\AskSLib.dll
C:\Users\Christian\AppData\Local\Temp\atl80.dll
C:\Users\Christian\AppData\Local\Temp\avgnt.exe
C:\Users\Christian\AppData\Local\Temp\DRVMGT.DLL
C:\Users\Christian\AppData\Local\Temp\ewmoacxrsn.exe
C:\Users\Christian\AppData\Local\Temp\FP_PL_PFS_INSTALLER_32bit.exe
C:\Users\Christian\AppData\Local\Temp\Gw2.exe
C:\Users\Christian\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Christian\AppData\Local\Temp\jre-6u34-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Christian\AppData\Local\Temp\mfc80.dll
C:\Users\Christian\AppData\Local\Temp\mfc80u.dll
C:\Users\Christian\AppData\Local\Temp\mfcm80.dll
C:\Users\Christian\AppData\Local\Temp\mfcm80u.dll
C:\Users\Christian\AppData\Local\Temp\msvcm80.dll
C:\Users\Christian\AppData\Local\Temp\msvcp80.dll
C:\Users\Christian\AppData\Local\Temp\msvcr80.dll
C:\Users\Christian\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Christian\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Christian\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Christian\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\Christian\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Christian\AppData\Local\Temp\nvStereoApiI64.dll
C:\Users\Christian\AppData\Local\Temp\nvStInst.exe
C:\Users\Christian\AppData\Local\Temp\oxwarncesm.exe
C:\Users\Christian\AppData\Local\Temp\siinst.exe
C:\Users\Christian\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Christian\AppData\Local\Temp\strings.dll
C:\Users\Christian\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Christian\AppData\Local\Temp\TmDbg32.dll
C:\Users\Christian\AppData\Local\Temp\TmDbg64.dll
C:\Users\Christian\AppData\Local\Temp\_isC73F.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

4
Restore point made on: 2013-11-09 00:32:25
Restore point made on: 2013-11-14 16:05:06
Restore point made on: 2013-11-20 14:34:58
Restore point made on: 2013-11-20 14:35:06

==================== Memory info =========================== 

Percentage of memory in use: 16%
Total physical RAM: 4095.27 MB
Available physical RAM: 3412.66 MB
Total Pagefile: 4093.42 MB
Available Pagefile: 3460.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:218.24 GB) (Free:60.8 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: () (Removable) (Total:0.97 GB) (Free:0.92 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: D9B3496E)
Partition 1: (Not Active) - (Size=15 GB) - (Type=1C)
Partition 2: (Active) - (Size=218 GB) - (Type=07 NTFS)
Attempted reading MBR returned 0 bytes.
 Could not read MBR for disk 1.


LastRegBack: 2013-11-19 15:15

==================== End Of Log ============================

Ich bedanke mich schonmal im Voraus für eure Hilfe!

Mit freundlichen Grüßen,
blind310

 

Themen zu Interpol-Trojaner, Win7
adobe, akamai, antivir, association, asus, avira, computer, desktop, dll, explorer, flash player, home, nvidia, pup.optional.softonic.a, realtek, registry, scan, secur, services.exe, svchost.exe, system, system neu, trojan.fakems, trojan.ransom.ed, vista, winlogon.exe


« GVU Trojaner WinXP Abgesicherter Modus geht nicht | Bedrohung gefunden, konnte aber nicht desinfiziert werden. »


Ähnliche Themen: Interpol-Trojaner, Win7


  1. Win7: Interpol Browser Sperre und anschließende Probleme mit Avira und Registry
    Plagegeister aller Art und deren Bekämpfung - 09.06.2015 (18)
  2. Interpol-Trojaner auf Win7 Rechner
    Log-Analyse und Auswertung - 13.11.2014 (12)
  3. Win7 64bit gesperrt von "schweizer Interpol"
    Plagegeister aller Art und deren Bekämpfung - 02.06.2014 (5)
  4. Win7 64bit gesperrt von "schweizer Interpol"
    Mülltonne - 30.05.2014 (0)
  5. Interpol hat zugeschlagen! Interpol Troyaner/Virus legt Rechner Lahm!
    Log-Analyse und Auswertung - 30.03.2014 (7)
  6. Trojaner Interpol Win XP - trotz abgesicherten Modus kein Zugriff - Standard AW: Trojaner Interpol Win XP - trotz abgesicherten Modus kein
    Log-Analyse und Auswertung - 18.02.2014 (18)
  7. GVU Interpol Trojaner!
    Plagegeister aller Art und deren Bekämpfung - 20.01.2014 (1)
  8. Interpol/BKA Trojaner
    Log-Analyse und Auswertung - 07.01.2014 (11)
  9. Interpol BKA/GVU Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 16.12.2013 (5)
  10. Interpol Trojaner
    Plagegeister aller Art und deren Bekämpfung - 28.11.2013 (22)
  11. Interpol - Trojaner - Win7 64 Bit - Code Tag
    Log-Analyse und Auswertung - 28.11.2013 (3)
  12. Firefox WIN7 Bundespolizei/Interpol Tap/Fenster nicht schließbar
    Plagegeister aller Art und deren Bekämpfung - 09.11.2013 (4)
  13. Win7/32 Rechner gesperrt mit Interpol Seite
    Log-Analyse und Auswertung - 04.11.2013 (13)
  14. GVU-Interpol-BKA-Trojaner
    Log-Analyse und Auswertung - 01.11.2013 (17)
  15. Interpol Trojaner GVU
    Log-Analyse und Auswertung - 26.10.2013 (7)
  16. Trojaner - Interpol
    Plagegeister aller Art und deren Bekämpfung - 12.08.2013 (3)
  17. Win7: Interpol Trojaner - Logfile Farbar Recovery Scan Tool
    Log-Analyse und Auswertung - 11.08.2013 (7)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Interpol-Trojaner, Win7 - Hallo zusammen, Ich habe seit 2 Wochen auf meinem alten Laptop den Interpol-Trojaner. Anfangs hat er nicht jedes Mal ausgeschlagen, aber inzwischen poppt der schon auf, sobald ich den Laptop - Interpol-Trojaner, Win7...
Archiv
Du betrachtest: Interpol-Trojaner, Win7 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22