Jump to content

scrinject.b.gen in Browser Cache

rohmann

By rohmann
in Resolved Malware Removal Logs

 Share

Recommended Posts

rohmann

rohmann

Posted
Posted

Hi!

I have a Chrome Portable Browser in a TrueCrypt container. Now I've checked it with Nod32 and it found 2 scrinject.b.gen Viruses in the browser cache. Nod32 then deleted it, when scanning again it diedn't find anything. Am I infected?

Here the Nod32 Scan:

Version der Signaturdatenbank: 6673 (20111130)
Datum: 01.12.2011 Uhrzeit: 10:14:00
Geprüfte Laufwerke, Ordner und Dateien: M:\Bootsektor;M:\;V:\Bootsektor;V:\
M:\Backup\IronPortable\Profile\Default\Cache\f_000 0df - HTML/ScrInject.B.Gen Virus - Aktionsauswahl aufgeschoben bis zum Abschluss des Scans
M:\Backup\IronPortable\Profile\Default\Cache\f_000 0e6 - HTML/ScrInject.B.Gen Virus - Aktionsauswahl aufgeschoben bis zum Abschluss des Scans
M:\Backup\IronPortable\Profile\Default\Cache\f_000 2cf » GZIP » f_0002cf - Archiv beschädigt
M:\Backup\IronPortable\Profile\Default\Cache\f_000 2d0 » GZIP » f_0002d0 - Archiv beschädigt
M:\Dropbox\Software\KeePass-1.20-Setup.exe » INNO » files.info - Option wird nicht unterstützt
M:\Dropbox\Software\KeePass-2.17-Setup.exe » INNO » files.info - Option wird nicht unterstützt
M:\Eigene Dateien\pinfect.zip » ZIP » ARJ.PIF - Fehler - Datei ist passwortgeschützt
M:\Eigene Dateien\pinfect.zip » ZIP » LHA.PIF - Fehler - Datei ist passwortgeschützt
M:\Eigene Dateien\pinfect.zip » ZIP » NOCLOSE.PIF - Fehler - Datei ist passwortgeschützt
M:\Eigene Dateien\pinfect.zip » ZIP » RAR.PIF - Fehler - Datei ist passwortgeschützt
M:\Eigene Dateien\pinfect.zip » ZIP » UC.PIF - Fehler - Datei ist passwortgeschützt
M:\Eigene Dateien\Dao\material dao\SoftonicDownloader_fuer_mozilla-firefox.exe - Variante von Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung - Aktionsauswahl aufgeschoben bis zum Abschluss des Scans
V:\Backup\clockworkmod\backup\2011-11-29.16.06.48_MIUI\data.ext4.tar » TAR » data/data/com.android.email/files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\Backup\clockworkmod\backup\2011-11-29.16.06.48_MIUI\data.ext4.tar » TAR » data/data/com.ideashower.readitlater.pro/app_plugins/com.adobe.flashplayer/.macromedia/Flash_Player/ - Archiv beschädigt
V:\Backup\download\miui_ger_GALAXY_S2_1.11.25_FULL _EN_DE.zip » ZIP » system/lib/libiprouteutil.so - Archiv beschädigt - Datei kann nicht extrahiert werden
V:\Backup\download\miui_ger_GALAXY_S2_1.11.25_FULL _EN_DE.zip » ZIP » - Archiv beschädigt
V:\Backup\MIUI\theme\Blue Dado浅色版_(798299.1).mtz.temp » ZIP » boots/bootanimation.zip » ZIP » part1/0033.jpg - Archiv beschädigt
V:\Backup\MIUI\theme\ozgurce-en_(802118.1).mtz.temp » ZIP » icons » ZIP » com.gameloft.android.GAND.GloftHAWX.Hawx.png - Archiv beschädigt
V:\Backup\MIUI\theme\雾里看花_(799447.1).mtz.temp » ZIP » wallpaper/default_lock_wallpaper.jpg - Archiv beschädigt
V:\Backup\TitaniumBackup\com.android.email-20111127-121049.tar.gz » GZIP » com.android.email-20111127-121049.tar » TAR » data/data/com.android.email/./files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\Backup\TitaniumBackup\com.samsung.swift.app.kie sair-20111127-121254.tar.gz » GZIP » com.samsung.swift.app.kiesair-20111127-121254.tar » TAR » data/data/com.samsung.swift.app.kiesair/./files/www/apps/KiesAir/js/commands/serviceCommands/musics/ - Archiv beschädigt
V:\external_sd\clockworkmod\2011-11-27.17.49.12_cm7.1\data.ext4.tar » TAR » data/data/com.android.email/files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\external_sd\clockworkmod\2011-11-27.17.49.12_cm7.1\data.ext4.tar » TAR » data/data/com.ideashower.readitlater.pro/app_plugins/com.adobe.flashplayer/.macromedia/Flash_Player/ - Archiv beschädigt
V:\external_sd\clockworkmod\2011-11-28.16.39.59_MIUI\data.ext4.tar » TAR » data/data/com.android.email/files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\external_sd\clockworkmod\2011-11-28.16.39.59_MIUI\data.ext4.tar » TAR » data/data/com.ideashower.readitlater.pro/app_plugins/com.adobe.flashplayer/.macromedia/Flash_Player/ - Archiv beschädigt
V:\external_sd\clockworkmod\2011-11-29.12.07.21_MIUI\data.ext4.tar » TAR » data/data/com.android.email/files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\external_sd\clockworkmod\2011-11-29.12.07.21_MIUI\data.ext4.tar » TAR » data/data/com.ideashower.readitlater.pro/app_plugins/com.adobe.flashplayer/.macromedia/Flash_Player/ - Archiv beschädigt
V:\external_sd\clockworkmod\2011-11-29.12.46.34_MIUI\data.ext4.tar » TAR » data/data/com.android.email/files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\external_sd\clockworkmod\2011-11-29.12.46.34_MIUI\data.ext4.tar » TAR » data/data/com.ideashower.readitlater.pro/app_plugins/com.adobe.flashplayer/.macromedia/Flash_Player/ - Archiv beschädigt
V:\external_sd\clockworkmod\2011-11-29.15.36.20_MIUI\data.ext4.tar » TAR » data/data/com.android.email/files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\external_sd\clockworkmod\2011-11-29.15.36.20_MIUI\data.ext4.tar » TAR » data/data/com.ideashower.readitlater.pro/app_plugins/com.adobe.flashplayer/.macromedia/Flash_Player/ - Archiv beschädigt
V:\external_sd\clockworkmod\2011-11-29.16.06.48_MIUI\data.ext4.tar » TAR » data/data/com.android.email/files/tempFile » MIME - - OK (eingebettete Archive NICHT geprüft)
V:\external_sd\clockworkmod\2011-11-29.16.06.48_MIUI\data.ext4.tar » TAR » data/data/com.ideashower.readitlater.pro/app_plugins/com.adobe.flashplayer/.macromedia/Flash_Player/ - Archiv beschädigt
M:\Backup\IronPortable\Profile\Default\Cache\f_000 0df - HTML/ScrInject.B.Gen Virus - gelöscht - in Quarantäne kopiert
M:\Backup\IronPortable\Profile\Default\Cache\f_000 0e6 - HTML/ScrInject.B.Gen Virus - gelöscht - in Quarantäne kopiert
M:\Eigene Dateien\Dao\material dao\SoftonicDownloader_fuer_mozilla-firefox.exe - Variante von Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung - gelöscht - in Quarantäne kopiert
Geprüfte Objekte: 403572
Erkannte Bedrohungen: 3
Anzahl gesäuberter Objekte: 3
Abgeschlossen: 10:32:47 Benötigte Zeit: 1127 Sek. (00:18:47)

Then I've checked with Malwarebytes. There 9 Trojan warnings come up. However, I've read that these are false positives:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8283

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

01.12.2011 15:40:34
mbam-log-2011-12-01 (15-40-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|M:\|V:\|)
Durchsuchte Objekte: 524118
Laufzeit: 1 Stunde(n), 21 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 9

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\glassfish3\jdk\jre\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\program files\Adobe\adobe dreamweaver cs5\JVM\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\program files\Adobe\adobe flash builder 4\jre\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\program files\Adobe\adobe flash catalyst cs5\jre\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\program files\common files\Java\java update\jaureg.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\program files\Java\jdk1.6.0_26\jre\bin\javacpl.cpl (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\program files\Java\jdk1.6.0_26\jre\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\program files\Java\jre6\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.
c:\programdata\Adobe\CS5\jre\bin\javacpl.exe (Trojan.Dropper.pws) -> Quarantined and deleted successfully.

Then I've scanned with Eset Online Scan:

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f84db619bb94b146a2ebaba9c5b51c12
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-12-02 12:20:51
# local_time=2011-12-02 01:20:51 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1033
# osver=6.0.6000 NT 
# compatibility_mode=512 16777215 100 0 3050146 3050146 0 0
# compatibility_mode=5893 16776574 100 94 9009 74389218 0 0
# compatibility_mode=8192 67108863 100 0 9142 9142 0 0
# scanned=338235
# found=5
# cleaned=0
# scan_time=70423
C:\$RECYCLE.BIN\S-1-5-21-807366929-668818633-305008010-9881\$REPCFUM.zip	Win32/RemoteAdmin.NetCat application (unable to clean)	00000000000000000000000000000000	I
C:\Programmdateien\winamp561_full_emusic-7plus_all.exe	Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000	I
C:\Programmdateien\winamp5622_full_emusic-7plus_all.exe	Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000	I
M:\Dropbox\Software\winamp5622_full_emusic-7plus_all.exe	Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000	I
M:\IronPortable\Profile\Default\Cache\f_0043ec	Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000	I

Then I've scanned with OTL (File attached, because too long

And Hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:15:08, on 01.12.2011
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
C:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Nimbuzz\Nimbuzz.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Sandboxie\SandboxieRpcSs.exe
C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
C:\Program Files\Sandboxie\SandboxieCrypto.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
M:\IronPortable\Iron\iron.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BHO_Startup - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [picon] "C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" -startup
O4 - HKLM\..\Run: [acevents] "C:\Program Files\ActivIdentity\ActivClient\acevents.exe"
O4 - HKLM\..\Run: [accrdsub] "C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterM odule
O4 - HKLM\..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.e xe"
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.ex e" -launchedbylogin
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [KeePass 2 PreLoad] "C:\Program Files\KeePass Password Safe 2\KeePass.exe" --preload
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [TIMEREC - Client] C:\Program Files\TIMEREC2\Client\TRC.exe
O4 - HKCU\..\Run: [Nimbuzz] C:\Program Files\Nimbuzz\Nimbuzz.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\r.\AppData\Local\Google\Update\GoogleUpd ate.exe" /c
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5 017F567343CA.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - Gopher Prefix: 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mmc.lan
O17 - HKLM\Software\..\Telephony: DomainName = mmc.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mmc.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mmc.lan
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\HEWLET~1\IAM\bin\APSHook.dll 
O20 - Winlogon Notify: DeviceNP - C:\Windows\SYSTEM32\DeviceNP.dll
O23 - Service: Emsisoft Anti-Malware 6.0 - Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe
O23 - Service: ActivIdentity Shared Store Service (ac.sharedstore) - ActivIdentity - C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: AuthenTec Fingerprint Service (ATService) - AuthenTec, Inc. - C:\Program Files\Fingerprint Sensor\AtService.exe
O23 - Service: CDMA Device Service - Unknown owner - C:\Program Files\Samsung\USB Drivers\26_VIA_driver2\x86\VIAService.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: HP ProtectTools Gerätesperre/Überwachung (FLCDLOCK) - Hewlett-Packard Ltd - C:\Windows\system32\flcdlock.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP ProtectTools Service - Hewlett-Packard Development Company, L.P - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
O23 - Service: Drive Encryption Service (HpFkCryptService) - McAfee, Inc. - C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
O23 - Service: File Sanitizer for HP ProtectTools (HPFSService) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe

--
End of file - 11879 bytes

Is the computer infected?

Regards,

Roman

Here the OTL Scan.

otl.txt

Link to post
Share on other sites
  • 2 weeks later...
  • 1 month later...
Maurice Naggar

Maurice Naggar

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.