| |
| |||||||
Log-Analyse und Auswertung: Win Vista: Avira meldet 'BOO/TDss.O' gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.12.2013, 14:41
| #16 |
 |  Win Vista: Avira meldet 'BOO/TDss.O' gefundenCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=50e6594b52671449b669fd2e546bc86c
# engine=16181
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-08 01:24:46
# local_time=2013-12-08 02:24:46 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 95 77430 157180391 12139 0
# compatibility_mode=5378 16777214 0 8 56315358 56331406 0 0
# compatibility_mode=5892 16776638 100 100 33350274 224041814 0 0
# scanned=353105
# found=9
# cleaned=0
# scan_time=14100
sh=1B55A807FB047C47C0CFF49162A91BE77E50F051 ft=1 fh=4a92c2fd18962af4 vn="a variant of Win32/Kryptik.UWS trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0005.dta"
sh=7C794856DA9A3D40740431C1C355324BF15F7B9F ft=1 fh=3c404436a28ba5f7 vn="a variant of Generik.CIVPCAN trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0006.dta"
sh=8FC47002C94322D27E7CC23DE0E09366278D1FAC ft=1 fh=b59116e9ea4b609b vn="Win32/Olmasco.O trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0007.dta"
sh=C1537F8F8308DB428A17D8309AF853CBDDD86378 ft=1 fh=c25e6ab804e54205 vn="Win64/Olmasco.X trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0008.dta"
sh=D5F20E8DD68BF3F2755756925DE31F78941EFD8F ft=1 fh=533da6b67824c7dc vn="a variant of Win32/Olmasco.O trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0009.dta"
sh=BD23CFA926B0FE04CDE450F63D7BDC381D238E12 ft=1 fh=e7aec2c971424e71 vn="Win64/Olmasco.V trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0010.dta"
sh=614A4E374797F94A1327F4C7D08A79A948660E9A ft=1 fh=1cb93ee4eea17c9e vn="Win32/Olmasco.Q trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0011.dta"
sh=0052E97FFDEB7172B5306B68B008697EB61862A4 ft=1 fh=98c9107c7a5c7106 vn="Win64/Olmasco.X trojan" ac=I fn="C:\TDSSKiller_Quarantine\07.12.2013_12.04.21\tdlfs0000\tsk0012.dta"
sh=8DDE856805780977C50D8D9B33E56A58CD7BF34C ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="F:\Users\Richard\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\44bc4adf-26fb1688"
Code:
ATTFilter Results of screen317's Security Check version 0.99.76 Windows Vista Service Pack 2 x86 (UAC is enabled) Internet Explorer 9 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` AVG AntiVirus Free Edition 2014 Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Java(TM) 6 Update 22 Java version out of Date! Adobe Flash Player 9 Flash Player out of Date! Adobe Flash Player 11.9.900.117 Adobe Reader 10.1.8 Adobe Reader out of Date! Mozilla Firefox (25.0.1) ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-12-2013 02
Ran by Richard (administrator) on RICHARD-PC on 08-12-2013 14:33:19
Running from C:\Users\Richard\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
(Spotify Ltd) C:\Users\Richard\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Fujitsu Siemens Computers) C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Dropbox, Inc.) C:\Users\Richard\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6111232 2008-04-25] (Realtek Semiconductor)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2014\avgui.exe [4956176 2013-11-07] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-29] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Richard\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-11-18] (Spotify Ltd)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Run: [AVG-Secure-Search-Update_0913b] - C:\Users\Richard\AppData\Roaming\AVG 0913b Campaign\AVG-Secure-Search-Update-0913b.exe /PROMPT --mid a25629733f7e47d18d83d14a4b47895b-e2d58aa5192df42f33b082801a16ed7e8dfe1348 --CMPID 0913b
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [202240 2008-01-21] (Microsoft Corporation)
MountPoints2: {16e47d92-032e-11e2-b577-00030da360a8} - F:\LaunchU3.exe -a
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
Startup: C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
SearchScopes: HKLM - DefaultScope value is missing.
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\evpl76q9.default
FF Homepage: hxxp://www.tagesschau.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\evpl76q9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-11-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-29] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 OsdService; C:\Program Files\OEM\OSD_1.12\OsdService.exe [94208 2008-02-22] (TODO: <公司名稱>)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 TestHandler; C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [303104 2008-04-25] (Fujitsu Siemens Computers)
==================== Drivers (Whitelisted) ====================
S4 ahcix86s; C:\Windows\system32\drivers\ahcix86s.sys [170000 2007-12-19] (AMD Technologies Inc.)
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [120600 2013-11-05] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [209176 2013-11-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147768 2013-10-24] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22840 2013-09-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [176952 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [222520 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [102712 2013-10-01] (AVG Technologies CZ, s.r.o.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-03] (Avira Operations GmbH & Co. KG)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27448 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [193848 2013-08-01] (AVG Technologies CZ, s.r.o.)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-11-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-29] (Avira Operations GmbH & Co. KG)
R3 CLEDX; C:\Windows\System32\DRIVERS\cledx.sys [33792 2005-05-09] (Team H2O)
S3 GpdDevDPort; C:\Windows\system32\directport.sys [7168 2007-11-21] ()
S3 GpdKbFilter; C:\Windows\system32\kbfiltr.sys [8192 2008-03-31] (Windows (R) Codename Longhorn DDK provider)
S4 JRAID; C:\Windows\system32\drivers\jraid.sys [76688 2008-04-03] (JMicron Technology Corp.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R2 RVIEG01; C:\Program Files\Roland\Virtual Sound Canvas DXi\RVIEg01.sys [187992 2001-04-13] (Roland)
R2 RVIEGVST; C:\Program Files\Roland\Virtual Sound Canvas VST\RVIEg01VST.sys [188276 2001-04-13] (Roland)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-31] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Richard\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-08 14:33 - 2013-12-08 14:33 - 00000000 ____D C:\Users\Richard\Downloads\FRST-OlderVersion
2013-12-08 14:28 - 2013-12-08 10:24 - 00891184 _____ C:\Users\Richard\Desktop\SecurityCheck.exe
2013-12-08 10:24 - 2013-12-08 10:24 - 00891184 _____ C:\Users\Richard\Downloads\SecurityCheck.exe
2013-12-08 10:23 - 2013-12-08 10:23 - 02347384 _____ (ESET) C:\Users\Richard\Downloads\esetsmartinstaller_enu.exe
2013-12-07 21:02 - 2013-12-07 21:02 - 00000808 _____ C:\Users\Richard\Desktop\PDF Architect.lnk
2013-12-07 21:01 - 2013-12-07 21:01 - 00000000 ____D C:\Users\Richard\Documents\PDF Architect Files
2013-12-07 21:01 - 2013-12-07 21:01 - 00000000 ____D C:\Program Files\PDF Architect
2013-12-07 21:00 - 2013-12-07 21:02 - 00000000 ____D C:\Program Files\PDFCreator
2013-12-07 21:00 - 2013-12-07 21:00 - 00000834 _____ C:\Users\Public\Desktop\PDFCreator.lnk
2013-12-07 21:00 - 2013-12-07 21:00 - 00000000 ____D C:\Users\Richard\AppData\Roaming\pdfforge
2013-12-07 21:00 - 2013-04-09 14:13 - 00095416 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2013-12-07 21:00 - 2012-05-05 10:54 - 00662288 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCT2.OCX
2013-12-07 21:00 - 2012-05-05 10:54 - 00137000 _____ (Microsoft Corporation) C:\Windows\system32\MSMAPI32.OCX
2013-12-07 21:00 - 2012-05-05 10:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\MSMPIDE.DLL
2013-12-07 21:00 - 1998-07-06 17:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\system32\VB6DE.DLL
2013-12-07 21:00 - 1998-07-06 17:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\MSCMCDE.DLL
2013-12-07 21:00 - 1998-07-06 17:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\MSCC2DE.DLL
2013-12-07 20:47 - 2013-12-07 20:50 - 69734576 _____ (pdfforge ) C:\Users\Richard\Downloads\PDFCreator-1_7_2_setup_offline.exe
2013-12-07 20:39 - 2013-12-07 20:44 - 00415527 _____ C:\Windows\system32\~.tmp
2013-12-07 20:30 - 2013-12-07 20:34 - 00415527 _____ C:\Users\Richard\Documents\~.tmp
2013-12-07 13:40 - 2013-12-08 14:33 - 01060441 _____ (Farbar) C:\Users\Richard\Downloads\FRST.exe
2013-12-07 13:37 - 2013-12-07 13:37 - 00001195 _____ C:\Users\Richard\Desktop\JRT.txt
2013-12-07 13:33 - 2013-12-07 13:33 - 00000000 ____D C:\Windows\ERUNT
2013-12-07 13:24 - 2013-12-07 13:25 - 00000000 ____D C:\AdwCleaner
2013-12-07 12:20 - 2013-12-07 12:20 - 00000000 ____D C:\Users\Richard\AppData\Roaming\Malwarebytes
2013-12-07 12:19 - 2013-12-07 12:19 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-07 12:19 - 2013-12-07 12:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-07 12:19 - 2013-12-07 12:19 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-07 12:19 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-07 12:07 - 2013-12-07 12:07 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-12-07 12:06 - 2013-12-07 12:06 - 01034531 _____ (Thisisu) C:\Users\Richard\Downloads\JRT.exe
2013-12-07 12:05 - 2013-12-07 12:05 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Richard\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-07 12:05 - 2013-12-07 12:05 - 01110034 _____ C:\Users\Richard\Downloads\adwcleaner.exe
2013-12-06 12:17 - 2013-12-08 09:54 - 00003510 _____ C:\Windows\PFRO.log
2013-12-06 10:16 - 2013-12-06 10:18 - 00000000 ___SD C:\ComboFix
2013-12-05 11:12 - 2013-12-05 11:12 - 00000000 ____D C:\Qoobox
2013-12-05 11:12 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-05 11:12 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-05 11:12 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-05 11:12 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-05 11:12 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-05 11:12 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-05 11:12 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-05 11:12 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-05 11:11 - 2013-12-06 10:16 - 00000000 ___SD C:\32788R22FWJFW
2013-12-05 11:11 - 2013-12-05 11:11 - 00000000 ____D C:\Windows\erdnt
2013-12-05 11:08 - 2013-12-06 10:11 - 05153080 ____R (Swearware) C:\Users\Richard\Desktop\ComboFix.exe
2013-12-02 10:25 - 2013-12-02 10:25 - 00002651 _____ C:\Users\Richard\Downloads\GMER.log
2013-12-02 10:08 - 2013-12-02 10:08 - 01110476 _____ C:\Users\Richard\Downloads\7z920.exe
2013-12-02 10:03 - 2013-12-02 10:03 - 00377856 _____ C:\Users\Richard\Downloads\gmer_2.1.19163.exe
2013-12-02 10:02 - 2013-12-02 10:03 - 00000476 _____ C:\Users\Richard\Downloads\defogger_disable.log
2013-12-02 10:02 - 2013-12-02 10:02 - 00050477 _____ C:\Users\Richard\Downloads\Defogger.exe
2013-12-02 10:02 - 2013-12-02 10:02 - 00000000 _____ C:\Users\Richard\defogger_reenable
2013-12-02 09:33 - 2013-12-02 09:34 - 00015931 _____ C:\Users\Richard\Downloads\Addition.txt
2013-12-02 09:32 - 2013-12-08 14:33 - 00012683 _____ C:\Users\Richard\Downloads\FRST.txt
2013-12-02 09:32 - 2013-12-08 14:33 - 00000000 ____D C:\FRST
2013-11-30 20:25 - 2013-11-30 20:25 - 04101441 _____ C:\Users\Richard\Downloads\tdsskiller.zip
2013-11-30 20:25 - 2013-11-30 20:25 - 00000000 ____D C:\Users\Richard\Desktop\tdsskiller
2013-11-30 20:18 - 2013-11-18 09:28 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Richard\Desktop\tdsskiller.exe
2013-11-27 12:19 - 2013-11-27 12:19 - 106424558 _____ C:\Windows\system32\咁ॎ᭄™
2013-11-19 14:47 - 2013-11-19 14:48 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-11-19 14:47 - 2013-11-19 14:48 - 00000000 ____D C:\Program Files\iTunes
2013-11-19 14:47 - 2013-11-19 14:47 - 00000000 ____D C:\Program Files\iPod
2013-11-19 14:06 - 2013-11-19 14:09 - 98633040 _____ (Apple Inc.) C:\Users\Richard\Downloads\iTunesSetup.exe
2013-11-18 10:49 - 2013-11-18 10:50 - 19071742 _____ C:\Users\Richard\Downloads\Jonas-Burgwinkel-Press-Pictures.zip
2013-11-17 21:50 - 2013-11-17 21:52 - 164009087 _____ C:\Users\Richard\Downloads\sascha-26-10-13.zip
2013-11-15 21:56 - 2013-11-15 21:56 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-14 09:01 - 2013-10-13 11:42 - 12344832 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 09:01 - 2013-10-13 11:08 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 09:01 - 2013-10-13 10:48 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 09:01 - 2013-10-13 10:37 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 09:01 - 2013-10-13 10:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-14 09:01 - 2013-10-13 10:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 09:01 - 2013-10-13 10:33 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-14 09:01 - 2013-10-13 10:32 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 09:01 - 2013-10-13 10:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 09:01 - 2013-10-13 10:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-14 09:01 - 2013-10-13 10:29 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-14 09:01 - 2013-10-13 10:27 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 09:01 - 2013-10-13 10:27 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 09:01 - 2013-10-13 10:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-14 09:01 - 2013-10-13 10:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 09:01 - 2013-10-13 10:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-13 14:07 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 14:07 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 14:07 - 2013-10-11 01:39 - 00218228 _____ C:\Windows\system32\WFP.TMF
2013-11-13 14:07 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 14:07 - 2013-10-03 13:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
==================== One Month Modified Files and Folders =======
2013-12-08 14:33 - 2013-12-08 14:33 - 00000000 ____D C:\Users\Richard\Downloads\FRST-OlderVersion
2013-12-08 14:33 - 2013-12-07 13:40 - 01060441 _____ (Farbar) C:\Users\Richard\Downloads\FRST.exe
2013-12-08 14:33 - 2013-12-02 09:32 - 00012683 _____ C:\Users\Richard\Downloads\FRST.txt
2013-12-08 14:33 - 2013-12-02 09:32 - 00000000 ____D C:\FRST
2013-12-08 14:28 - 2008-07-03 05:11 - 00042749 _____ C:\ProgramData\nvModes.001
2013-12-08 14:00 - 2011-10-10 17:01 - 01365789 _____ C:\Windows\WindowsUpdate.log
2013-12-08 13:55 - 2006-11-02 13:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-08 13:55 - 2006-11-02 13:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-08 10:29 - 2012-02-21 19:29 - 00000000 ____D C:\Users\Richard\AppData\Roaming\Dropbox
2013-12-08 10:25 - 2008-01-21 08:16 - 01445310 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-08 10:24 - 2013-12-08 14:28 - 00891184 _____ C:\Users\Richard\Desktop\SecurityCheck.exe
2013-12-08 10:24 - 2013-12-08 10:24 - 00891184 _____ C:\Users\Richard\Downloads\SecurityCheck.exe
2013-12-08 10:23 - 2013-12-08 10:23 - 02347384 _____ (ESET) C:\Users\Richard\Downloads\esetsmartinstaller_enu.exe
2013-12-08 10:00 - 2011-11-07 17:58 - 00000000 ____D C:\ProgramData\MFAData
2013-12-08 09:56 - 2012-02-21 19:32 - 00000000 ___RD C:\Users\Richard\Dropbox
2013-12-08 09:55 - 2008-07-03 05:11 - 00042749 _____ C:\ProgramData\nvModes.dat
2013-12-08 09:55 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-08 09:54 - 2013-12-06 12:17 - 00003510 _____ C:\Windows\PFRO.log
2013-12-08 00:10 - 2006-11-02 14:01 - 00032538 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-07 21:02 - 2013-12-07 21:02 - 00000808 _____ C:\Users\Richard\Desktop\PDF Architect.lnk
2013-12-07 21:02 - 2013-12-07 21:00 - 00000000 ____D C:\Program Files\PDFCreator
2013-12-07 21:01 - 2013-12-07 21:01 - 00000000 ____D C:\Users\Richard\Documents\PDF Architect Files
2013-12-07 21:01 - 2013-12-07 21:01 - 00000000 ____D C:\Program Files\PDF Architect
2013-12-07 21:00 - 2013-12-07 21:00 - 00000834 _____ C:\Users\Public\Desktop\PDFCreator.lnk
2013-12-07 21:00 - 2013-12-07 21:00 - 00000000 ____D C:\Users\Richard\AppData\Roaming\pdfforge
2013-12-07 20:50 - 2013-12-07 20:47 - 69734576 _____ (pdfforge ) C:\Users\Richard\Downloads\PDFCreator-1_7_2_setup_offline.exe
2013-12-07 20:44 - 2013-12-07 20:39 - 00415527 _____ C:\Windows\system32\~.tmp
2013-12-07 20:42 - 2013-09-26 09:46 - 00000000 ____D C:\Program Files\PDF24
2013-12-07 20:34 - 2013-12-07 20:30 - 00415527 _____ C:\Users\Richard\Documents\~.tmp
2013-12-07 13:37 - 2013-12-07 13:37 - 00001195 _____ C:\Users\Richard\Desktop\JRT.txt
2013-12-07 13:33 - 2013-12-07 13:33 - 00000000 ____D C:\Windows\ERUNT
2013-12-07 13:25 - 2013-12-07 13:24 - 00000000 ____D C:\AdwCleaner
2013-12-07 13:18 - 2012-09-06 10:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-07 12:37 - 2011-10-10 17:09 - 00000000 ____D C:\Users\Richard
2013-12-07 12:20 - 2013-12-07 12:20 - 00000000 ____D C:\Users\Richard\AppData\Roaming\Malwarebytes
2013-12-07 12:19 - 2013-12-07 12:19 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-07 12:19 - 2013-12-07 12:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-07 12:19 - 2013-12-07 12:19 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-07 12:07 - 2013-12-07 12:07 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-12-07 12:06 - 2013-12-07 12:06 - 01034531 _____ (Thisisu) C:\Users\Richard\Downloads\JRT.exe
2013-12-07 12:05 - 2013-12-07 12:05 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Richard\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-07 12:05 - 2013-12-07 12:05 - 01110034 _____ C:\Users\Richard\Downloads\adwcleaner.exe
2013-12-06 12:14 - 2011-10-10 18:09 - 00000000 ____D C:\Users\Richard\AppData\Roaming\Winamp
2013-12-06 10:18 - 2013-12-06 10:16 - 00000000 ___SD C:\ComboFix
2013-12-06 10:16 - 2013-12-05 11:11 - 00000000 ___SD C:\32788R22FWJFW
2013-12-06 10:11 - 2013-12-05 11:08 - 05153080 ____R (Swearware) C:\Users\Richard\Desktop\ComboFix.exe
2013-12-05 22:49 - 2008-07-03 14:25 - 00000000 ____D C:\Windows\Panther
2013-12-05 13:24 - 2011-11-17 13:11 - 00000000 ____D C:\bb
2013-12-05 11:12 - 2013-12-05 11:12 - 00000000 ____D C:\Qoobox
2013-12-05 11:11 - 2013-12-05 11:11 - 00000000 ____D C:\Windows\erdnt
2013-12-03 15:55 - 2011-10-10 17:15 - 00000000 ____D C:\Users\Richard\Documents\Rechnungen, Verträge, Angebote
2013-12-03 14:48 - 2013-07-31 18:05 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-02 10:25 - 2013-12-02 10:25 - 00002651 _____ C:\Users\Richard\Downloads\GMER.log
2013-12-02 10:08 - 2013-12-02 10:08 - 01110476 _____ C:\Users\Richard\Downloads\7z920.exe
2013-12-02 10:03 - 2013-12-02 10:03 - 00377856 _____ C:\Users\Richard\Downloads\gmer_2.1.19163.exe
2013-12-02 10:03 - 2013-12-02 10:02 - 00000476 _____ C:\Users\Richard\Downloads\defogger_disable.log
2013-12-02 10:02 - 2013-12-02 10:02 - 00050477 _____ C:\Users\Richard\Downloads\Defogger.exe
2013-12-02 10:02 - 2013-12-02 10:02 - 00000000 _____ C:\Users\Richard\defogger_reenable
2013-12-02 09:34 - 2013-12-02 09:33 - 00015931 _____ C:\Users\Richard\Downloads\Addition.txt
2013-11-30 20:25 - 2013-11-30 20:25 - 04101441 _____ C:\Users\Richard\Downloads\tdsskiller.zip
2013-11-30 20:25 - 2013-11-30 20:25 - 00000000 ____D C:\Users\Richard\Desktop\tdsskiller
2013-11-29 12:25 - 2012-10-18 00:33 - 00000000 ____D C:\Users\Richard\AppData\Roaming\Spotify
2013-11-29 11:32 - 2013-07-31 18:05 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-29 11:32 - 2013-07-31 18:05 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-27 12:19 - 2013-11-27 12:19 - 106424558 _____ C:\Windows\system32\咁ॎ᭄™
2013-11-27 10:18 - 2013-10-29 09:47 - 00000864 _____ C:\Users\Public\Desktop\AVG 2014.lnk
2013-11-27 10:16 - 2011-11-07 19:17 - 00000000 ___HD C:\$AVG
2013-11-25 22:15 - 2012-10-18 00:33 - 00000000 ____D C:\Users\Richard\AppData\Local\Spotify
2013-11-25 11:31 - 2012-07-27 10:54 - 00000000 ____D C:\Users\Richard\AppData\Local\Paint.NET
2013-11-23 13:50 - 2013-07-26 11:31 - 00000000 ____D C:\Users\Richard\Documents\C-Sheets
2013-11-22 11:03 - 2011-11-18 21:13 - 00000000 ____D C:\Users\Richard\AppData\Roaming\Skype
2013-11-19 14:48 - 2013-11-19 14:47 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-11-19 14:48 - 2013-11-19 14:47 - 00000000 ____D C:\Program Files\iTunes
2013-11-19 14:47 - 2013-11-19 14:47 - 00000000 ____D C:\Program Files\iPod
2013-11-19 14:47 - 2013-02-06 12:26 - 00000000 ____D C:\ProgramData\Apple Computer
2013-11-19 14:47 - 2012-10-14 22:38 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-11-19 14:09 - 2013-11-19 14:06 - 98633040 _____ (Apple Inc.) C:\Users\Richard\Downloads\iTunesSetup.exe
2013-11-19 10:19 - 2013-07-29 11:04 - 00000000 ____D C:\Windows\system32\MRT
2013-11-18 10:50 - 2013-11-18 10:49 - 19071742 _____ C:\Users\Richard\Downloads\Jonas-Burgwinkel-Press-Pictures.zip
2013-11-18 09:28 - 2013-11-30 20:18 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Richard\Desktop\tdsskiller.exe
2013-11-17 21:52 - 2013-11-17 21:50 - 164009087 _____ C:\Users\Richard\Downloads\sascha-26-10-13.zip
2013-11-17 12:43 - 2012-07-21 09:51 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-15 21:56 - 2013-11-15 21:56 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-14 09:54 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-11-14 09:34 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-14 08:58 - 2006-11-02 11:24 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
ZeroAccess:
C:\Users\Richard\AppData\Local\7dcd0ae1
C:\Users\Richard\AppData\Local\7dcd0ae1\@
C:\Users\Richard\AppData\Local\7dcd0ae1\loader.tlb
Files to move or delete:
====================
C:\ProgramData\0tbpw.pad
Some content of TEMP:
====================
C:\Users\Richard\AppData\Local\Temp\avgnt.exe
C:\Users\Richard\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-08 10:03
==================== End Of Log ============================
--- --- --- --- --- --- Avira meldet sich noch immer nach dem Neustart mit der gleichen Meldung. Auch Eset hat ja scheinbar einige infizierte Dateien gefunden. Viele Grüße Richard |
| Themen zu Win Vista: Avira meldet 'BOO/TDss.O' gefunden |
| avira, boo/tdss.o, entferne, entfernen, gefunde, geklickt, gescannt, immer wieder, laufwerk, mas, masterbootsektor, masterbootsektor hd0, melde, meldet, meldung, programm, schei, tdsskiller, virus, vista, win, win vista |
Baum-Darstellung