| |
| |||||||
Log-Analyse und Auswertung: Windows Vista Home SP2_32Bit_Sperrschirm_SUISA_Nach Installation von Use-NeXTWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
11.12.2013, 10:17
| #5 |
 |  Windows Vista Home SP2_32Bit_Sperrschirm_SUISA_Nach Installation von Use-NeXT Hallo Schrauber, hat ein bisschen länger gedauert, wie geplant aber ist eben so... --> viel zu gerade.... Sorry... Nun ja, habe deinen Auftrag ausgeführt. Lief alles absolut ohne Probleme. Lehrbuch mässig... :-) Eure Anleitungen sind echt toll... :-) Hier die Logs: Malewarebytes Anti-Maleware: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.10.06 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Leo :: LEOS-PC [Administrator] Schutz: Aktiviert 10.12.2013 19:44:05 mbam-log-2013-12-10 (19-44-05).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 261567 Laufzeit: 5 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\Leo\AppData\Roaming\loadit.exe (Trojan.Agent.AI) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) ADWCleaner: Code:
ATTFilter # AdwCleaner v3.014 - Bericht erstellt am 10/12/2013 um 19:59:09
# Updated 01/12/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Leo - LEOS-PC
# Gestartet von : C:\Users\Leo\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Viewpoint
Ordner Gelöscht : C:\Program Files\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files\Viewpoint
Datei Gelöscht : C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\MetaStream
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Viewpoint
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\90C64EA18BA25EE488BF80DCF07F2FFD
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16520
*************************
AdwCleaner[R0].txt - [3532 octets] - [10/12/2013 19:56:38]
AdwCleaner[S0].txt - [3461 octets] - [10/12/2013 19:59:09]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3521 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Leo on 10.12.2013 at 20:53:13,45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files\eusing free registry cleaner"
Successfully deleted: [Folder] "C:\Users\Leo\AppData\Roaming\microsoft\windows\start menu\programs\free registry cleaner"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.12.2013 at 20:57:28,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Liebe Grüsse Leo Guten Morgen, ich habe das frische FRST log total vergessen.... hier ist es: FRST-Log (new)_11.12.2013: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-12-2013
Ran by Leo (administrator) on LEOS-PC on 11-12-2013 10:11:34
Running from C:\Users\Leo\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AOL LLC) C:\Program Files\Common Files\aol\acs\AOLacsd.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Dritek System Inc.) C:\Program Files\Medion Info Display\MdionLCMLH.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4186112 2006-12-01] (Realtek Semiconductor)
HKLM\...\Run: [MedionVFD] - C:\Program Files\Medion Info Display\MdionLCMLH.exe [208896 2006-12-29] (Dritek System Inc.)
HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [39792 2008-01-11] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [413696 2008-05-27] (Apple Inc.)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421736 2012-03-06] (Apple Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-18] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [202240 2008-01-18] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Melanie\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [ 2008-01-18] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
BootExecute: autocheck autochk /r \??\K:autocheck autochk *
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
========================== Services (Whitelisted) =================
R2 AOL ACS; C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [46640 2006-10-23] (AOL LLC)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-18] (Microsoft Corporation)
S3 CnxTrLan; C:\Windows\System32\DRIVERS\CnxTrLan.sys [25984 2005-04-18] (Conexant)
S3 CnxTrUsb; C:\Windows\System32\DRIVERS\CnxTrUsb.sys [52864 2005-04-18] (Conexant)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc. )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R2 Nsynas32; C:\Windows\System32\Drivers\Nsynas32.sys [17784 2001-04-09] (Syncrosoft Hard- und Software GmbH)
R1 PQNTDrv; C:\Windows\System32\Drivers\PQNTDrv.sys [4228 2002-09-16] (PowerQuest Corporation)
R0 videX32; C:\Windows\System32\DRIVERS\videX32.sys [9216 2006-10-17] (VIA Technologies, Inc.)
R3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-01] (America Online, Inc.)
R0 xfilt; C:\Windows\System32\DRIVERS\xfilt.sys [17920 2006-10-18] (VIA Technologies,Inc)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-18] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Leo\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U2 WZCSVC;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-10 21:10 - 2013-12-10 21:10 - 00000049 _____ C:\Windows\NeroDigital.ini
2013-12-10 20:57 - 2013-12-10 20:57 - 00000837 _____ C:\Users\Leo\Desktop\JRT.txt
2013-12-10 20:53 - 2013-12-10 20:53 - 00000000 ____D C:\Windows\ERUNT
2013-12-10 20:51 - 2013-12-10 20:51 - 00003601 _____ C:\Users\Leo\Desktop\AdwCleaner[S0].txt
2013-12-10 19:56 - 2013-12-10 19:59 - 00000000 ____D C:\AdwCleaner
2013-12-10 19:40 - 2013-12-10 19:40 - 00000000 ____D C:\Users\Leo\AppData\Roaming\Malwarebytes
2013-12-10 19:39 - 2013-12-10 19:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-10 19:39 - 2013-12-10 19:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-10 19:39 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-10 19:37 - 2013-12-10 19:35 - 01034531 _____ (Thisisu) C:\Users\Leo\Desktop\JRT.exe
2013-12-10 19:37 - 2013-12-10 19:33 - 01110034 _____ C:\Users\Leo\Desktop\adwcleaner.exe
2013-12-10 19:37 - 2013-12-10 19:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leo\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-08 11:00 - 2013-12-08 11:00 - 00006393 _____ C:\Users\Leo\Desktop\Combofix.txt
2013-12-08 10:54 - 2013-12-08 10:54 - 00006393 _____ C:\ComboFix.txt
2013-12-08 10:42 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-08 10:42 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-08 10:42 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-08 10:42 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-08 10:42 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-08 10:42 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-08 10:42 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-08 10:42 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-08 10:19 - 2013-12-08 10:54 - 00000000 ____D C:\Qoobox
2013-12-08 10:18 - 2013-12-08 10:54 - 00000000 ____D C:\Windows\erdnt
2013-12-08 10:15 - 2013-12-08 07:47 - 05153293 ____R (Swearware) C:\Users\Leo\Desktop\ComboFix.exe
2013-12-06 21:46 - 2013-12-06 21:46 - 00000659 _____ C:\Users\Leo\Desktop\gmer.txt
2013-12-06 21:45 - 2013-12-06 21:45 - 00000659 _____ C:\Users\Leo\Desktop\Gmer.log
2013-12-06 21:21 - 2013-12-06 21:23 - 00019274 _____ C:\Users\Leo\Desktop\Addition.txt
2013-12-06 21:20 - 2013-12-11 10:11 - 00007465 _____ C:\Users\Leo\Desktop\FRST.txt
2013-12-06 21:20 - 2013-12-06 21:20 - 00000000 ____D C:\FRST
2013-12-06 21:19 - 2013-12-06 21:19 - 00000468 _____ C:\Users\Leo\Desktop\defogger_disable.log
2013-12-06 21:19 - 2013-12-06 21:19 - 00000000 _____ C:\Users\Leo\defogger_reenable
2013-12-06 21:07 - 2013-12-06 21:07 - 00377856 _____ C:\Users\Leo\Desktop\gmer_2.1.19163.exe
2013-12-06 21:04 - 2013-12-06 21:04 - 01925820 _____ (Farbar) C:\Users\Leo\Desktop\FRST64.exe
2013-12-06 21:03 - 2013-12-06 21:03 - 01058547 _____ (Farbar) C:\Users\Leo\Desktop\FRST.exe
2013-12-06 21:00 - 2013-12-06 21:00 - 00050477 _____ C:\Users\Leo\Desktop\Defogger.exe
2013-12-04 23:01 - 2013-12-04 23:01 - 00007976 _____ C:\Users\Melanie\Desktop\rom-13120423010.bin
2013-12-04 21:52 - 2013-12-04 21:53 - 00000000 ____D C:\Users\Melanie\AppData\Roaming\vlc
2013-12-02 21:46 - 2013-12-02 22:21 - 00000000 ____D C:\Users\Melanie\Desktop\Links Hausbau
2013-11-16 02:09 - 2013-10-13 11:08 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-16 02:09 - 2013-10-13 10:48 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-16 02:09 - 2013-10-13 10:37 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-16 02:09 - 2013-10-13 10:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-16 02:09 - 2013-10-13 10:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-16 02:09 - 2013-10-13 10:33 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-16 02:09 - 2013-10-13 10:32 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-16 02:09 - 2013-10-13 10:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-16 02:09 - 2013-10-13 10:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-16 02:09 - 2013-10-13 10:29 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-16 02:09 - 2013-10-13 10:27 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-16 02:09 - 2013-10-13 10:27 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-16 02:09 - 2013-10-13 10:26 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-16 02:09 - 2013-10-13 10:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-16 02:09 - 2013-10-13 10:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-16 02:08 - 2013-10-13 11:42 - 12344832 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-15 21:53 - 2013-11-15 21:53 - 00000169 _____ C:\Users\Melanie\Downloads\mp3_128.asx
2013-11-15 19:07 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-15 19:07 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-15 19:07 - 2013-10-11 01:39 - 00218228 _____ C:\Windows\system32\WFP.TMF
2013-11-15 19:07 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-15 19:07 - 2013-10-03 13:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
==================== One Month Modified Files and Folders =======
2013-12-11 10:11 - 2013-12-06 21:20 - 00007465 _____ C:\Users\Leo\Desktop\FRST.txt
2013-12-11 10:11 - 2007-06-04 19:53 - 01314708 _____ C:\Windows\WindowsUpdate.log
2013-12-11 10:08 - 2007-06-12 15:46 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-11 10:08 - 2006-11-02 14:01 - 00032558 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-11 10:08 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-11 10:08 - 2006-11-02 13:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-11 10:08 - 2006-11-02 13:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-10 21:10 - 2013-12-10 21:10 - 00000049 _____ C:\Windows\NeroDigital.ini
2013-12-10 20:57 - 2013-12-10 20:57 - 00000837 _____ C:\Users\Leo\Desktop\JRT.txt
2013-12-10 20:53 - 2013-12-10 20:53 - 00000000 ____D C:\Windows\ERUNT
2013-12-10 20:51 - 2013-12-10 20:51 - 00003601 _____ C:\Users\Leo\Desktop\AdwCleaner[S0].txt
2013-12-10 20:07 - 2006-11-02 11:33 - 01445352 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-10 19:59 - 2013-12-10 19:56 - 00000000 ____D C:\AdwCleaner
2013-12-10 19:59 - 2010-04-28 20:45 - 00000000 ____D C:\ProgramData\ICQ
2013-12-10 19:54 - 2007-02-07 15:37 - 00096744 _____ C:\Windows\PFRO.log
2013-12-10 19:54 - 2006-12-11 14:03 - 00000000 ____D C:\Windows\Panther
2013-12-10 19:40 - 2013-12-10 19:40 - 00000000 ____D C:\Users\Leo\AppData\Roaming\Malwarebytes
2013-12-10 19:39 - 2013-12-10 19:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-10 19:39 - 2013-12-10 19:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-10 19:35 - 2013-12-10 19:37 - 01034531 _____ (Thisisu) C:\Users\Leo\Desktop\JRT.exe
2013-12-10 19:33 - 2013-12-10 19:37 - 01110034 _____ C:\Users\Leo\Desktop\adwcleaner.exe
2013-12-10 19:31 - 2013-12-10 19:37 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leo\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-08 11:00 - 2013-12-08 11:00 - 00006393 _____ C:\Users\Leo\Desktop\Combofix.txt
2013-12-08 10:54 - 2013-12-08 10:54 - 00006393 _____ C:\ComboFix.txt
2013-12-08 10:54 - 2013-12-08 10:19 - 00000000 ____D C:\Qoobox
2013-12-08 10:54 - 2013-12-08 10:18 - 00000000 ____D C:\Windows\erdnt
2013-12-08 10:54 - 2006-11-02 12:18 - 00000000 ___RD C:\Users\Public
2013-12-08 10:53 - 2006-11-02 11:23 - 00000215 _____ C:\Windows\system.ini
2013-12-08 10:37 - 2013-05-19 10:49 - 00001912 _____ C:\Windows\epplauncher.mif
2013-12-08 07:47 - 2013-12-08 10:15 - 05153293 ____R (Swearware) C:\Users\Leo\Desktop\ComboFix.exe
2013-12-06 21:56 - 2010-01-29 11:52 - 00001356 _____ C:\Users\Leo\AppData\Local\d3d9caps.dat
2013-12-06 21:46 - 2013-12-06 21:46 - 00000659 _____ C:\Users\Leo\Desktop\gmer.txt
2013-12-06 21:45 - 2013-12-06 21:45 - 00000659 _____ C:\Users\Leo\Desktop\Gmer.log
2013-12-06 21:23 - 2013-12-06 21:21 - 00019274 _____ C:\Users\Leo\Desktop\Addition.txt
2013-12-06 21:20 - 2013-12-06 21:20 - 00000000 ____D C:\FRST
2013-12-06 21:19 - 2013-12-06 21:19 - 00000468 _____ C:\Users\Leo\Desktop\defogger_disable.log
2013-12-06 21:19 - 2013-12-06 21:19 - 00000000 _____ C:\Users\Leo\defogger_reenable
2013-12-06 21:19 - 2007-06-04 20:03 - 00000000 ____D C:\Users\Leo
2013-12-06 21:07 - 2013-12-06 21:07 - 00377856 _____ C:\Users\Leo\Desktop\gmer_2.1.19163.exe
2013-12-06 21:04 - 2013-12-06 21:04 - 01925820 _____ (Farbar) C:\Users\Leo\Desktop\FRST64.exe
2013-12-06 21:03 - 2013-12-06 21:03 - 01058547 _____ (Farbar) C:\Users\Leo\Desktop\FRST.exe
2013-12-06 21:00 - 2013-12-06 21:00 - 00050477 _____ C:\Users\Leo\Desktop\Defogger.exe
2013-12-04 23:01 - 2013-12-04 23:01 - 00007976 _____ C:\Users\Melanie\Desktop\rom-13120423010.bin
2013-12-04 21:53 - 2013-12-04 21:52 - 00000000 ____D C:\Users\Melanie\AppData\Roaming\vlc
2013-12-02 22:21 - 2013-12-02 21:46 - 00000000 ____D C:\Users\Melanie\Desktop\Links Hausbau
2013-11-19 11:21 - 2009-10-04 18:07 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-16 19:25 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-11-16 19:05 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-16 02:08 - 2013-08-16 19:55 - 00000000 ____D C:\Windows\system32\MRT
2013-11-16 02:08 - 2010-01-31 18:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-16 02:05 - 2006-11-02 11:24 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-11-15 21:53 - 2013-11-15 21:53 - 00000169 _____ C:\Users\Melanie\Downloads\mp3_128.asx
2013-11-15 20:05 - 2008-11-22 07:58 - 00033792 _____ C:\Users\Melanie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-15 20:04 - 2008-05-21 19:49 - 00072000 _____ C:\Users\Melanie\AppData\Local\GDIPFONTCACHEV1.DAT
Some content of TEMP:
====================
C:\Users\Leo\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-10 20:16
==================== End Of Log ============================
--- --- --- --- --- --- Ein "Addition.txt"-File wurde von der Software nicht generiert. (zur Info) Danke und Grüsse Leo |
| Themen zu Windows Vista Home SP2_32Bit_Sperrschirm_SUISA_Nach Installation von Use-NeXT |
| adobe, bingbar, bonjour, computer, defender, error, excel, fehlermeldung, flash player, frst:, home, iexplore.exe, installation, loadit.exe, melani, mp3, netzwerk, plug-in, realtek, registry, rundll, security, services.exe, starten, super, svchost.exe, synology, system, temp, vista, windows, windows xp, wsearch |
Baum-Darstellung