| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Problem mit ExploitJava/Obfuscator.AHWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.06.2015, 22:39
| #7 |
 |  Problem mit ExploitJava/Obfuscator.AH Hallo Matthias, habe Combofix durchgeführt. Hier die Log-Datei: [Combofix Logfile: Code:
ATTFilter ComboFix 15-06-24.02 - msi 24.06.2015 23:01:28.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3839.2084 [GMT 2:00]
ausgeführt von:: c:\users\msi\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\msi\AppData\Local\Microsoft\Windows\Temporary Internet Files\eportoZip
c:\windows\PFRO.log
c:\windows\SysWow64\DEBUG.log
C:\WindowsLiveMessenger-uccapi-0.uccapilog
D:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-05-24 bis 2015-06-24 ))))))))))))))))))))))))))))))
.
.
2015-06-24 21:19 . 2015-06-24 21:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-06-24 20:15 . 2015-06-12 07:50 12221144 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A369A1DD-3D8B-462A-ADA0-CC73EBD5668E}\mpengine.dll
2015-06-24 04:48 . 2015-06-24 04:50 -------- d-----w- C:\FRST
2015-06-23 18:42 . 2015-05-03 03:16 12214312 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-06-22 12:56 . 2015-06-22 12:56 -------- d-----w- c:\program files (x86)\Common Files\Canon
2015-06-21 12:34 . 2015-06-21 13:39 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-06-21 12:19 . 2015-06-21 12:19 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Exploit
2015-06-21 12:06 . 2015-06-24 09:20 -------- d-----w- c:\programdata\Malwarebytes Anti-Exploit
2015-06-20 11:15 . 2015-06-20 11:15 -------- d-----w- c:\programdata\Spamihilator
2015-06-20 11:01 . 2015-06-24 18:13 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-06-20 10:58 . 2015-06-21 12:32 107736 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-06-20 10:58 . 2015-06-20 20:59 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2015-06-20 10:58 . 2015-06-20 10:58 -------- d-----w- c:\programdata\Malwarebytes
2015-06-20 10:58 . 2015-04-14 07:37 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-06-20 10:58 . 2015-04-14 07:37 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-06-20 09:56 . 2015-06-20 09:56 20592 ----a-w- c:\program files (x86)\Mozilla Firefox\AccessibleMarshal.dll
2015-06-20 09:56 . 2015-06-20 09:56 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2015-06-20 09:56 . 2015-06-20 09:56 109680 ----a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
2015-06-20 09:56 . 2015-06-20 09:56 51312 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2015-06-19 11:29 . 2015-06-19 11:29 970912 ----a-w- c:\windows\SysWow64\msvcr120.dll
2015-06-19 11:29 . 2015-06-19 11:29 455328 ----a-w- c:\windows\SysWow64\msvcp120.dll
2015-06-19 11:29 . 2015-06-19 11:29 247984 ----a-w- c:\windows\SysWow64\vccorlib120.dll
2015-06-19 11:14 . 2015-06-20 11:07 -------- d-----w- c:\users\msi\AppData\Roaming\Spamihilator
2015-06-18 06:29 . 2015-03-27 02:12 1187344 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4BFEC7FF-377F-40FF-9CB7-91FCB84DB606}\gapaengine.dll
2015-06-12 08:00 . 2015-06-12 08:00 -------- d-----w- c:\programdata\scripts
2015-06-10 05:42 . 2015-05-22 18:48 633856 ----a-w- c:\windows\system32\ieui.dll
2015-06-08 11:27 . 2015-06-08 11:27 -------- d-----w- c:\users\msi\.android
2015-06-06 10:48 . 2015-06-06 10:59 -------- d-----w- C:\AdwCleaner
2015-06-01 06:22 . 2015-06-01 06:22 -------- d-----w- c:\users\msi\AppData\Local\GWX
2015-05-28 09:24 . 2015-05-28 09:24 -------- d-----w- c:\users\msi\AppData\Roaming\TomTom
2015-05-28 09:24 . 2015-05-28 09:24 -------- d-----w- c:\users\msi\AppData\Local\TomTom
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-06-24 13:17 . 2014-02-14 14:11 778416 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-06-24 13:17 . 2014-02-14 14:11 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-06-10 20:08 . 2011-03-29 10:09 140135120 ----a-w- c:\windows\system32\MRT.exe
2015-05-25 18:01 . 2015-06-10 05:43 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-05-01 13:17 . 2015-05-16 20:01 124112 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-01 13:16 . 2015-05-16 20:01 102608 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-04-20 03:17 . 2015-05-16 10:19 1179136 ----a-w- c:\windows\system32\FntCache.dll
2015-04-20 03:17 . 2015-05-16 10:19 1647104 ----a-w- c:\windows\system32\DWrite.dll
2015-04-20 02:56 . 2015-05-16 10:19 1250816 ----a-w- c:\windows\SysWow64\DWrite.dll
2015-04-18 03:10 . 2015-05-16 10:23 460800 ----a-w- c:\windows\system32\certcli.dll
2015-04-18 02:56 . 2015-05-16 10:23 342016 ----a-w- c:\windows\SysWow64\certcli.dll
2015-04-13 03:28 . 2015-05-16 10:19 328704 ----a-w- c:\windows\system32\services.exe
2015-04-08 03:29 . 2015-05-16 10:17 275456 ----a-w- c:\windows\system32\InkEd.dll
2015-04-08 03:29 . 2015-05-16 10:17 24576 ----a-w- c:\windows\system32\jnwmon.dll
2015-04-08 03:14 . 2015-05-16 10:17 216064 ----a-w- c:\windows\SysWow64\InkEd.dll
2015-04-01 15:58 . 2011-09-27 20:03 87704 ----a-w- c:\windows\cadkasdeinst01.exe
2015-03-27 02:12 . 2014-01-23 17:58 1187344 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-04-28 14:40 223432 ----a-w- c:\users\msi\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-04-28 14:40 223432 ----a-w- c:\users\msi\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-04-28 14:40 223432 ----a-w- c:\users\msi\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Malwarebytes Anti-Exploit"="c:\program files (x86)\Malwarebytes Anti-Exploit\mbae.exe" [2015-04-08 2618680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"ArcSoft Connection Service"=c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"PPort11reminder"="c:\program files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 tor;Tor Win32 Service;c:\program files (x86)\Tor\tor.exe;c:\program files (x86)\Tor\tor.exe [x]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys;c:\windows\SYSNATIVE\Drivers\btmcom.sys [x]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys;c:\windows\SYSNATIVE\DRIVERS\enecirhid.sys [x]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys;c:\windows\SYSNATIVE\DRIVERS\enecirhidma.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R4 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [x]
R4 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe;c:\program files\Motorola\Bluetooth\audiosrv.exe [x]
R4 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe;c:\program files\Motorola\Bluetooth\obexsrv.exe [x]
S0 nvamacpi;NVIDIA Away Mode System;c:\windows\system32\DRIVERS\NVAMACPI.sys;c:\windows\SYSNATIVE\DRIVERS\NVAMACPI.sys [x]
S1 ESProtectionDriver;Malwarebytes Anti-Exploit;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae64.sys;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [x]
S1 Uim_DEVIM;UIM Direct Device Image Plugin;c:\windows\system32\DRIVERS\uim_devim.sys;c:\windows\SYSNATIVE\DRIVERS\uim_devim.sys [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 MbaeSvc;Malwarebytes Anti-Exploit Service;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
S2 WMI_Hook_Service;WMI_Hook_Service;c:\program files\msi\WMIHookBtnFn\WMI_Hook_Service.exe;c:\program files\msi\WMIHookBtnFn\WMI_Hook_Service.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys;c:\windows\SYSNATIVE\DRIVERS\enecir.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192se.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 85673518
*NewlyCreated* - BIONTDRV
*NewlyCreated* - MBAMSWISSARMY
*Deregistered* - 85673518
*Deregistered* - BioNTDrv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{07e84f41-11d5-4615-aaf6-368df0762b41}]
2011-12-20 14:04 154256 ---ha-w- c:\programdata\Duden\DKReg.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-06-23 05:45 990024 ----a-w- c:\program files (x86)\Google\Chrome\Application\43.0.2357.130\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-06-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-14 13:17]
.
2015-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-31 19:30]
.
2015-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-31 19:30]
.
2015-06-24 c:\windows\Tasks\Paragon Archive name diff_110615090256676.job
- c:\program files\Paragon Software\Backup and Recovery 2014 Free\program\scripts.exe [2014-05-19 12:40]
.
2015-06-24 c:\windows\Tasks\Paragon Archive name diff_180615150414946.job
- c:\program files\Paragon Software\Backup and Recovery 2014 Free\program\scripts.exe [2014-05-19 12:40]
.
2015-06-24 c:\windows\Tasks\Paragon Archive name diff_240615094426317.job
- c:\program files\Paragon Software\Backup and Recovery 2014 Free\program\scripts.exe [2014-05-19 12:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-04-28 14:40 262344 ----a-w- c:\users\msi\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-04-28 14:40 262344 ----a-w- c:\users\msi\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-04-28 14:40 262344 ----a-w- c:\users\msi\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-09-30 8123936]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 1337000]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\msi\AppData\Roaming\Mozilla\Firefox\Profiles\jpoytse6.default-1433586802832\
FF - prefs.js: browser.startup.homepage - about:home|about:addons
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{2247a894-1cf2-41be-b39a-beaba7cadcdc} - (no file)
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{5CCF8330-F742-411A-8A04-719806D168B5} - msiexec
Toolbar-Locked - (no file)
HKLM-Run-HookKey - c:\program files (x86)\msi\WMIHookBtnFn\HookKey.exe
AddRemove-JScreenFix - c:\windows\system32\javaws.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2423097191-3365315248-2331400100-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2423097191-3365315248-2331400100-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-06-24 23:28:45
ComboFix-quarantined-files.txt 2015-06-24 21:28
.
Vor Suchlauf: 10 Verzeichnis(se), 22.751.698.944 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 22.489.509.888 Bytes frei
.
- - End Of File - - D52CF134535C6C4E17A51A0B9DDD3967
A36C5E4F47E84449FF07ED3517B43A31 CODE] Hätte noch ne Frage zu den USB-Sticks und SD Karten. Habe diese in den letzten Tagen auch auf den PC verwendet. Müssen diese nicht auch gescant werden??? Viele Grüße Bettina |
| Themen zu Problem mit ExploitJava/Obfuscator.AH |
| angezeigt, antivierenprogramm, bedrohung, entfern, entfernt, essen, langsam, nicht sicher, nutze, pc läuft, problem, programm, quara, quarantäne, scan, screenshot, security, sehr langsam, system, virus, weiterhelfen, windows, windows security, windows7, wirklich |
Baum-Darstellung