| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: HTML/Crypted.Gen - bin auch betroffenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
23.11.2014, 12:26
| #1 |
 |  HTML/Crypted.Gen - bin auch betroffen Hallo, habe seit 3 Wochen Probleme mit Malware HTML/Crypted.Gen u. vereinzelt auch mit ADWARE/InstallerCore.Gen7. AVIRA ist nicht in der Lage mir zu helfen und wende mich deshalb wieder an Euch. Frst64 Log poste ich hiermit; FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-11-2014 01 Ran by SYSTEM on MININT-68REICL on 23-11-2014 11:29:37 Running from f:\ Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log. Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-06] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [dit] => C:\Windows\dit.exe [69632 2002-09-05] () Startup: C:\Users\**************\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation) ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [806704 2014-11-06] (Avira Operations GmbH & Co. KG) S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG) S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [995064 2014-11-06] (Avira Operations GmbH & Co. KG) S3 Browser7Maintenance; C:\Program Files (x86)\Browser 7 Maintenance Service\maintenanceservice.exe [118584 2014-09-04] (Deutsche Telekom AG) S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation) S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [450904 2014-09-18] (Garmin Ltd or its subsidiaries) S2 Urcoospawperming; C:\Program Files (x86)\Urcoospawperming\Urcoospawperming.exe [4377560 2014-11-03] () ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-09-26] (Avira Operations GmbH & Co. KG) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-09-26] (Avira Operations GmbH & Co. KG) S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-09-26] (Avira Operations GmbH & Co. KG) S2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [43064 2014-09-26] (Avira Operations GmbH & Co. KG) S3 MODEMCSA; C:\Windows\system32\drivers\MODEMCSA.sys [24064 2009-07-14] (Microsoft Corporation) S3 smserial; C:\Windows\System32\DRIVERS\smserial.sys [1202688 2009-05-05] (Motorola Inc.) S5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation) S3 ATICDSDr; \??\C:\Users\***************\AppData\Local\Temp\ATICDSDr.sys [X] S3 AtiDCM; \??\C:\Users\****************\AppData\Local\Temp\atidcmxx.sys [X] S2 sbapifs; system32\DRIVERS\sbapifs.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-23 11:29 - 2014-11-23 11:29 - 00000000 ____D () C:\FRST 2014-11-19 18:50 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll 2014-11-19 18:50 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\System32\pku2u.dll 2014-11-19 18:50 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-19 18:50 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2014-11-12 16:56 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2014-11-12 16:56 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-11-12 16:56 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2014-11-12 16:56 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll 2014-11-12 16:56 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2014-11-12 16:56 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll 2014-11-12 16:56 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2014-11-12 16:56 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2014-11-12 16:56 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe 2014-11-12 16:56 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-11-12 16:56 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe 2014-11-12 16:56 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-11-12 16:56 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-11-12 16:56 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-11-12 16:56 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll 2014-11-12 16:56 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-11-12 16:56 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-11-12 16:56 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-11-12 16:56 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-11-12 16:56 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-11-12 16:56 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-11-12 16:56 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll 2014-11-12 16:56 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-11-12 16:56 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-11-12 16:56 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2014-11-12 16:56 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2014-11-12 16:56 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2014-11-12 16:56 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-11-12 16:56 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-11-12 16:56 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-11-12 16:56 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-11-12 16:56 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-11-12 16:56 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-11-12 16:56 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2014-11-12 16:56 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-11-12 16:56 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2014-11-12 16:56 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-11-12 16:56 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-11-12 16:55 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2014-11-12 16:55 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2014-11-12 16:55 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll 2014-11-12 16:55 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2014-11-12 16:55 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2014-11-12 16:55 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2014-11-12 16:55 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll 2014-11-12 16:55 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2014-11-12 16:55 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll 2014-11-12 16:55 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-11-12 16:55 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-11-12 16:55 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll 2014-11-12 16:55 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2014-11-12 16:55 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll 2014-11-12 16:55 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-11-12 16:55 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2014-11-12 16:55 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2014-11-12 16:55 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-11-12 16:50 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll 2014-11-12 16:50 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll 2014-11-12 16:49 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll 2014-11-12 16:49 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2014-11-12 16:49 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll 2014-11-12 16:49 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll 2014-11-12 16:49 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll 2014-11-12 16:49 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll 2014-11-12 16:49 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-11-12 16:49 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-11-12 16:49 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2014-11-12 16:49 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2014-11-12 16:44 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll 2014-11-12 16:44 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-11-12 16:44 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2014-11-12 16:44 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\System32\AUDIOKSE.dll 2014-11-12 16:44 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\System32\audiosrv.dll 2014-11-12 16:44 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\System32\AudioEng.dll 2014-11-12 16:44 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\System32\AudioSes.dll 2014-11-12 16:44 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\System32\EncDump.dll 2014-11-12 16:44 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2014-11-12 16:44 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2014-11-12 16:44 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2014-11-12 16:44 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll 2014-11-12 16:44 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll 2014-11-12 16:44 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2014-11-12 16:44 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll 2014-11-12 16:44 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll 2014-11-12 16:44 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll 2014-11-12 16:44 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-11-12 16:44 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-11-12 16:44 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-11-12 16:44 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-11-12 16:44 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-11-12 16:44 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-11-12 16:44 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2014-11-12 16:44 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml3r.dll 2014-11-12 16:44 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-11-12 16:44 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-11-12 16:44 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\System32\IMJP10K.DLL 2014-11-12 16:44 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL 2014-11-12 16:43 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\System32\oleaut32.dll 2014-11-12 16:43 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2014-11-12 16:43 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll 2014-11-12 16:43 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-11-11 17:14 - 2014-11-11 17:14 - 02717673 _____ () C:\Users\*****************\Desktop\AVSUPINF.7z 2014-11-11 16:52 - 2014-11-11 16:52 - 01658352 _____ () C:\Users\*****************\Downloads\avira_support_collector_de(2).exe 2014-11-11 16:49 - 2014-11-11 16:49 - 01658352 _____ () C:\Users\*****************\Desktop\avira_support_collector_de(1).exe 2014-11-11 16:18 - 2014-11-11 16:18 - 01658352 _____ () C:\Users\*****************\Downloads\avira_support_collector_de.exe 2014-11-11 14:01 - 2014-11-11 14:01 - 00000000 ____D () C:\Users\*****************\AppData\Roaming\Deutsche Telekom AG 2014-11-11 14:01 - 2014-11-11 14:01 - 00000000 ____D () C:\Users\*****************\AppData\Local\Deutsche Telekom AG 2014-11-10 17:12 - 2014-11-10 17:12 - 00000000 ____D () C:\Windows\SysWOW64\Garmin 2014-11-10 16:46 - 2014-11-10 16:46 - 00001372 _____ () C:\Users\Public\Desktop\Browser 7 der Telekom.lnk 2014-11-10 16:46 - 2014-11-10 16:46 - 00000000 ____D () C:\ProgramData\Telekom-Browser 7 2014-11-10 16:46 - 2014-11-10 16:46 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG 2014-11-10 16:46 - 2014-11-10 16:46 - 00000000 ____D () C:\Program Files (x86)\Browser 7 Maintenance Service 2014-11-09 14:42 - 2014-11-09 14:44 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys 2014-11-09 14:42 - 2014-11-09 14:44 - 00001154 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-11-09 14:42 - 2014-11-09 14:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-11-09 14:42 - 2014-11-09 14:42 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-09 14:42 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys 2014-11-09 14:42 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys 2014-11-09 14:42 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2014-11-09 11:00 - 2014-11-09 11:00 - 00000000 ____D () C:\ubuntu 2014-11-08 20:41 - 2014-11-08 20:41 - 00000000 ____D () C:\Windows\pss 2014-11-08 12:36 - 2014-11-08 12:36 - 00000000 ____D () C:\Windows\SysWOW64\iosubsys 2014-11-08 12:36 - 2002-10-24 15:12 - 00053248 _____ () C:\Windows\Dit.dll 2014-11-08 12:36 - 2002-09-05 18:14 - 00069632 _____ () C:\Windows\Dit.exe 2014-11-08 12:36 - 2002-09-05 14:21 - 00024576 _____ () C:\Windows\CICache.exe 2014-11-08 12:36 - 2002-07-12 10:29 - 00065536 _____ () C:\Windows\DitExp.exe 2014-11-08 12:36 - 2002-06-24 15:41 - 00049265 _____ (Windows (R) 2000 DDK provider) C:\Windows\SysWOW64\Drivers\Usbarw.sys 2014-11-08 12:36 - 2002-06-21 15:55 - 00000208 _____ () C:\Windows\Dit.ini 2014-11-08 12:36 - 2002-06-18 22:41 - 00145612 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Drivers\Usbsys9x.sys 2014-11-08 12:27 - 2014-11-08 12:27 - 00000000 ___RD () C:\Users\*****************\Documents\Notes 2014-11-06 17:57 - 2014-11-06 17:57 - 00000000 ____D () C:\Program Files\SyncToy 2.1 2014-11-06 17:56 - 2014-11-06 17:56 - 00000000 ____D () C:\Program Files\Microsoft Sync Framework 2014-11-05 17:04 - 2014-11-05 20:24 - 00000760 _____ () C:\Users\*****************\Desktop\Continue Microsoft Office 2010.lnk 2014-11-05 15:43 - 2014-11-09 14:35 - 00000000 ____D () C:\AdwCleaner 2014-11-04 19:00 - 2014-11-04 19:07 - 00001272 _____ () C:\Windows\System32\Drivers\kgpcpy.cfg 2014-11-04 18:52 - 2014-11-04 18:52 - 00003124 _____ () C:\Windows\System32\Tasks\{92BBEF79-5658-434F-972A-8077C8023A02} 2014-11-04 16:40 - 2014-11-04 16:40 - 00000000 ____D () C:\Users\*****************\AppData\Roaming\Macromedia 2014-11-04 16:20 - 2014-11-23 11:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-04 16:20 - 2014-11-22 18:57 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-04 16:20 - 2014-11-22 18:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-04 16:20 - 2014-11-22 18:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-04 16:20 - 2014-11-04 16:20 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-11-04 16:20 - 2014-11-04 16:20 - 00000000 ____D () C:\Windows\System32\Macromed 2014-11-04 16:19 - 2014-11-10 16:34 - 00000000 ____D () C:\Users\*****************\AppData\Local\Adobe 2014-11-04 16:08 - 2014-11-04 16:08 - 00000000 ____D () C:\Users\*****************\AppData\Roaming\DriverFinder 2014-11-04 15:57 - 2014-11-04 15:57 - 00000000 ___RD () C:\Users\*****************\OneDrive 2014-11-04 15:57 - 2014-11-04 15:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive 2014-11-04 15:56 - 2014-11-04 15:56 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive 2014-11-04 15:42 - 2014-11-04 15:42 - 00000000 ____D () C:\Users\*****************\Documents\OneNote-Notizbücher 2014-11-04 15:41 - 2014-11-04 15:41 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform 2014-11-04 15:41 - 2014-11-04 15:41 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-11-04 15:35 - 2014-11-15 18:54 - 00000000 ____D () C:\Program Files\Microsoft Office 15 2014-11-04 15:20 - 2014-11-04 15:20 - 00000000 __SHD () C:\Program Files (x86)\Urcoospawperming 2014-11-02 18:13 - 2014-11-02 18:13 - 00000000 __SHD () C:\Users\Familie\AppData\Local\EmieUserList 2014-11-02 18:13 - 2014-11-02 18:13 - 00000000 __SHD () C:\Users\Familie\AppData\Local\EmieSiteList ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-23 11:21 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-23 11:20 - 2009-07-14 05:51 - 00050359 _____ () C:\Windows\setupact.log 2014-11-22 19:30 - 2014-10-11 10:45 - 01251611 _____ () C:\Windows\WindowsUpdate.log 2014-11-22 19:03 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-11-22 19:03 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-11-16 18:04 - 2014-10-11 12:51 - 00310270 _____ () C:\Windows\PFRO.log 2014-11-13 18:32 - 2009-07-14 05:45 - 00300840 _____ () C:\Windows\System32\FNTCACHE.DAT 2014-11-13 18:29 - 2014-10-11 13:34 - 00000000 ___SD () C:\Windows\System32\CompatTel 2014-11-12 17:32 - 2014-10-12 12:22 - 00000000 ____D () C:\Windows\System32\MRT 2014-11-12 17:30 - 2014-10-12 12:22 - 103374192 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2014-11-09 14:30 - 2009-07-14 18:58 - 00699342 _____ () C:\Windows\System32\perfh007.dat 2014-11-09 14:30 - 2009-07-14 18:58 - 00149450 _____ () C:\Windows\System32\perfc007.dat 2014-11-09 14:30 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\System32\PerfStringBackup.INI 2014-11-06 20:56 - 2014-10-11 11:25 - 00000000 ____D () C:\users\************** 2014-11-06 20:47 - 2014-10-11 16:03 - 00000000 ____D () C:\users\Familie 2014-11-06 20:47 - 2014-10-11 15:39 - 00000000 ____D () C:\users\Standardkonto 2014-11-06 20:47 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2014-11-06 19:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\NDF 2014-11-05 15:53 - 2014-10-11 13:19 - 00001101 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-11-05 15:53 - 2014-10-11 12:27 - 00001122 _____ () C:\Users\*****************\Desktop\Search.lnk 2014-11-04 19:25 - 2014-10-11 11:52 - 00067560 _____ () C:\Users\*****************\AppData\Local\GDIPFONTCACHEV1.DAT 2014-11-04 15:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-11-04 14:30 - 2014-10-11 11:05 - 00275080 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe Some content of TEMP: ==================== C:\Users\Familie\AppData\Local\Temp\avgnt.exe C:\Users\Standardkonto\AppData\Local\Temp\avgnt.exe C:\Users\*****************\AppData\Local\Temp\avgnt.exe C:\Users\*****************\AppData\Local\Temp\JBGNNC.exe C:\Users\*****************\AppData\Local\Temp\pyl903F.tmp.exe C:\Users\*****************\AppData\Local\Temp\pyl9F9A.tmp.exe C:\Users\*****************\AppData\Local\Temp\pylC755.tmp.exe C:\Users\*****************\AppData\Local\Temp\Quarantine.exe C:\Users\*****************\AppData\Local\Temp\sqlite3.dll ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== Restore Points ========================= ==================== Memory info =========================== Percentage of memory in use: 22% Total physical RAM: 2046.18 MB Available physical RAM: 1586.82 MB Total Pagefile: 2046.18 MB Available Pagefile: 1572.99 MB Total Virtual: 8192 MB Available Virtual: 8191.89 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:62.24 GB) (Free:27.41 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Work) (Fixed) (Total:49.55 GB) (Free:29.05 GB) NTFS Drive f: (PROGRAMME) (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 98CF2CE3) Partition 1: (Active) - (Size=62.2 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=49.5 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 7.5 GB) (Disk ID: AE36FE40) Partition 1: (Active) - (Size=7.5 GB) - (Type=0B) LastRegBack: 2014-11-05 17:36 ==================== End Of Log ============================ --- --- --- Geändert von wojobi (23.11.2014 um 12:50 Uhr) |
| Themen zu HTML/Crypted.Gen - bin auch betroffen |
| adobe flash player, adware.obronaads, adware/installcore.gen7, adware/installercore.gen7., browser, desktop, explorer, fehlercode 0x5, fehlercode 0xc0000005, fehlercode windows, flash player, html-scriptvirus html/crypted.gen, html/crypted.gen, malware, programme, pum.bad.proxy, registry, services.exe, svchost.exe, system, this device cannot start. (code10), windows, winlogon.exe |
Baum-Darstellung