|
Plagegeister aller Art und deren Bekämpfung: Reboot nach Dcom Server Prozessorstart wurde unerwartet beendetWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
04.02.2010, 22:38 | #1 |
| Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Hallo, ich habe seit ein paar Tagen schon das Problem, dass mein laptop nach der Fehlermeldung Dcom Server Prozessorstart wurde unerwartet beendet runter fährt und neu hoch. Das ging vor drei Tagen los, anfangs erst nur zwei mal am Tag und dachte der Laptop wäre zu heiß geworden. Seit gestern nun macht er den reboot in unregelmäi0gen Abständen. Ich habe gestern Avast Antivirus drüber laufen lassen der erst im abgesicherten Modus mit drei Trojaner gemeldet hat, die ich auch gelöscht habe. Danach war für den Rest des tages alles wieder so wie es sein soll, dafür macht er mir heute nach maximal anderthalb Stunden einen reboot. Ich habe Spybot Search and Destroy sowie Avast nochmals drüber laufen lassen, der mir zwei Trojaner gemeldet hat, die wieder gelöscht wurden, aber das hat das Problem nicht behoben. Nach Recherchen im Netz fand ich ich nur raus, dass es ein Virus sein muss und dass die meisten einen raten den Laptop neu aufzusetzen. Leider kann ich das nicht, weil ich keine Boot CD habe, da Vista auf dem Laptop drauf war und meine Recovery CD sich nicht wieder finden läßt. Was und wie kann ich da jetzt was tun um den verursachenden Virus loszuwerden?? |
07.02.2010, 13:42 | #2 |
| Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet So, ich habe es mittlerweile geschafft mal meine PC solange laufen zu lassen, dass ich Malwarebytes laufen lassen konnte und das RSIt
__________________Da mir der nach dem Malwarebytes leider wieder untergefahrenist habe ich das log nicht mehr. Ich habe aber die trojaner und Backdooragenten gelöscht und danach hat er nicht mehr gelöscht. Hier das RSIT Log , vll kann mir da jetzt einer helfen. |
07.02.2010, 13:42 | #3 |
| Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Logfile of random's system information tool 1.06 (written by random/random)
__________________Run by michiya at 2010-02-07 13:33:50 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 103 GB (70%) free of 146 GB Total RAM: 3069 MB (56% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:34:05, on 07.02.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18882) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Program Files\Launch Manager\LManager.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Users\michiya\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe C:\Windows\System32\rundll32.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\PLFSetI.exe C:\Program Files\Fingerprint Sensor\ATSwpNav.exe C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\avmwlanstick\FRITZWLANMini.exe C:\Program Files\OO Software\CleverCache\ooccctrl.exe C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Pando Networks\Media Booster\PMB.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Program Files\Acer\Acer VCM\AcerVCM.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe C:\Program Files\Acer\Acer VCM\acp2HID.exe C:\Program Files\ICQ7.0\ICQ.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe C:\Program Files\Java\jre6\bin\java.exe C:\Users\michiya\Desktop\RSIT.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\trend micro\michiya.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1208&m=aspire_4935 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://de.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://de.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://m.de.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://de.search.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://de.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://de.search.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://de.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://de.search.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: (no name) - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - (no file) O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: (no name) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file) O3 - Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - (no file) O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav.exe" -run O4 - HKLM\..\Run: [VitaKeyPdtWzd] C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKCU\..\Run: [lvbne] C:/Users/michiya/Downloads//sriiedv.exe O4 - HKCU\..\Run: [Messenger (Yahoo!)] ~"C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [ICQ] ~"C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4 O4 - HKCU\..\Run: [msnmsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe O4 - Global Startup: Acer VCM.lnk = ? O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe O9 - Extra button: SecretCity 3DChat - {D401C3A2-12EF-4D1D-A086-F3AB10B565BF} - C:\PROGRA~1\SECRET~1\\SECRET~1.EXE (file missing) O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\michiya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Program Files\avmwlanstick\WlanNetService.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- End of file - 16368 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] &Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2009-09-20 1172280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0C37B053-FD68-456a-82E1-D788EE342E6F}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}] ShowBarObj Class - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll [2008-07-29 312880] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-06-16 1144712] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2009-09-20 158008] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-07-29 142896] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2009-09-20 1172280] {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} {32099AAC-C132-4136-9E9A-4E364A424E17} {D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2009-06-16 1144712] {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184] "RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2008-10-13 6335008] "LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe [2008-09-26 854536] "eDataSecurity Loader"=C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe [2008-07-29 526896] "eAudio"=C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe [2008-09-11 544768] "BkupTray"=C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [2008-04-25 28672] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-10-17 13556256] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-10-17 92704] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-02-22 1037608] "PLFSetI"=C:\Windows\PLFSetI.exe [2008-07-29 200704] "ATSwpNav"=C:\Program Files\Fingerprint Sensor\ATSwpNav.exe [2008-05-30 1163264] "VitaKeyPdtWzd"=C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe [2008-10-14 3679744] "ePower_DMC"=C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [2008-08-01 405504] "ArcadeDeluxeAgent"=C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [2008-10-08 147456] "CLMLServer"=C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [2008-10-08 167936] "ProductReg"=C:\Program Files\Acer\WR_PopUp\ProductReg.exe [2008-09-23 6144] "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000] "AVMWlanClient"=C:\Program Files\avmwlanstick\FRITZWLANMini.exe [2007-02-02 283136] "ooccctrl.exe"=C:\Program Files\OO Software\CleverCache\ooccctrl.exe [2005-11-09 722944] "AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-08-13 177440] "Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2008-10-13 1833504] "YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2009-02-23 111856] "WinPatrol"=C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [2009-10-10 320832] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-03-09 37888] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-01-22 141608] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792] "PlayMovie"=C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [2008-10-17 167936] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952] "Search Protection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2009-02-23 111856] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480] "Pando Media Booster"=C:\Program Files\Pando Networks\Media Booster\PMB.exe [2009-12-26 2935480] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240] "DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200] "lvbne"=C:/Users/michiya/Downloads//sriiedv.exe [] "Messenger (Yahoo!)"=~C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe -quiet [] "ICQ"=~C:\Program Files\ICQ7.0\ICQ.exe silent loginmode=4 [] "msnmsgr"=~C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background [] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Acer VCM.lnk - C:\Program Files\Acer\Acer VCM\AcerVCM.exe C:\Users\michiya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"=C:\Program Files\Acer\Acer Bio Protection\PwdFilter [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "LogonHoursAction"=2 "DontDisplayLogonHoursWarnings"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=91000000 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent" "C:\Windows\system32\svchost.exe"="C:\Windows\system32\svchost.exe:*:Enabled:svchost.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9efe936d-072d-11de-9425-001eecd48d10}] shell\AutoRun\command - G:\pushinst.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f846229d-e4fa-11de-8177-00040ece079a}] shell\AutoRun\command - E:\bts.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe3ef27e-e334-11de-b67f-001eecd48d10}] shell\AutoRun\command - E:\pushinst.exe ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - C:\Windows\System32\WScript.exe "%1" %* ======List of files/folders created in the last 1 months====== 2010-02-07 13:33:50 ----D---- C:\rsit 2010-02-07 13:33:50 ----D---- C:\Program Files\trend micro 2010-02-06 12:55:08 ----A---- C:\Windows\ntbtlog.txt 2010-02-05 12:56:16 ----D---- C:\Users\michiya\AppData\Roaming\Malwarebytes 2010-02-05 12:56:08 ----D---- C:\ProgramData\Malwarebytes 2010-02-05 12:56:07 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-02-05 12:50:29 ----D---- C:\Program Files\CCleaner 2010-02-04 13:33:36 ----A---- C:\Windows\system32\ShellManager310E2D762.dll 2010-02-04 11:55:42 ----D---- C:\Program Files\iPod 2010-02-04 11:55:40 ----D---- C:\Program Files\iTunes 2010-02-04 11:53:00 ----D---- C:\Program Files\QuickTime 2010-02-03 14:59:23 ----A---- C:\Users\michiya\AppData\Roaming\acervcmtmp.ini 2010-02-03 13:06:57 ----D---- C:\Program Files\Microsoft Sync Framework 2010-02-03 13:05:52 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition 2010-02-03 13:05:07 ----D---- C:\Program Files\Microsoft 2010-02-03 13:04:47 ----D---- C:\Program Files\Windows Live SkyDrive 2010-02-03 13:04:25 ----D---- C:\Program Files\Windows Live 2010-02-03 13:04:12 ----D---- C:\Windows\PCHEALTH 2010-02-03 12:54:05 ----D---- C:\Program Files\Common Files\Windows Live 2010-02-03 12:53:36 ----D---- C:\Program Files\Microsoft Silverlight 2010-02-03 08:54:01 ----A---- C:\Windows\system32\winhttp.dll 2010-02-02 19:19:45 ----A---- C:\Windows\system32\kerberos.dll 2010-02-02 19:19:44 ----A---- C:\Windows\system32\schannel.dll 2010-02-02 19:18:38 ----SHD---- C:\Windows\system32\%APPDATA% 2010-02-02 19:18:19 ----D---- C:\ProgramData\Roaming 2010-02-02 19:17:33 ----D---- C:\Program Files\Cisco 2010-02-02 19:17:29 ----D---- C:\ProgramData\Intel 2010-02-02 19:17:29 ----D---- C:\Program Files\Common Files\Intel 2010-01-31 22:36:09 ----D---- C:\Users\michiya\AppData\Roaming\Reallusion 2010-01-31 22:33:17 ----D---- C:\e0da736e84196ba860 2010-01-28 20:50:52 ----D---- C:\ProgramData\Intenium 2010-01-28 20:50:29 ----D---- C:\Program Files\DEUTSCHLAND SPIELT 2010-01-23 21:31:58 ----A---- C:\Windows\_MSRSTRT.EXE 2010-01-23 20:39:50 ----A---- C:\Windows\system32\TUProgSt.exe 2010-01-23 20:39:38 ----D---- C:\Users\michiya\AppData\Roaming\TuneUp Software 2010-01-23 20:39:24 ----D---- C:\ProgramData\TuneUp Software 2010-01-23 20:38:59 ----SHD---- C:\ProgramData\{55A29068-F2CE-456C-9148-C869879E2357} 2010-01-23 20:37:20 ----D---- C:\Users\michiya\AppData\Roaming\WinPatrol 2010-01-23 20:37:10 ----D---- C:\Program Files\BillP Studios 2010-01-23 20:36:52 ----D---- C:\Program Files\Conduit 2010-01-23 20:29:03 ----D---- C:\Users\michiya\AppData\Roaming\Uniblue 2010-01-22 09:19:33 ----A---- C:\Windows\system32\mshtml.dll 2010-01-22 09:19:32 ----A---- C:\Windows\system32\ieframe.dll 2010-01-22 09:19:31 ----A---- C:\Windows\system32\urlmon.dll 2010-01-22 09:19:31 ----A---- C:\Windows\system32\iertutil.dll 2010-01-22 09:19:30 ----A---- C:\Windows\system32\wininet.dll 2010-01-22 09:19:30 ----A---- C:\Windows\system32\occache.dll 2010-01-22 09:19:30 ----A---- C:\Windows\system32\msfeeds.dll 2010-01-22 09:19:30 ----A---- C:\Windows\system32\ieui.dll 2010-01-22 09:19:30 ----A---- C:\Windows\system32\iedkcs32.dll 2010-01-22 09:19:29 ----A---- C:\Windows\system32\msfeedssync.exe 2010-01-22 09:19:29 ----A---- C:\Windows\system32\msfeedsbs.dll 2010-01-22 09:19:29 ----A---- C:\Windows\system32\jsproxy.dll 2010-01-22 09:19:29 ----A---- C:\Windows\system32\ieUnatt.exe 2010-01-22 09:19:29 ----A---- C:\Windows\system32\iesysprep.dll 2010-01-22 09:19:29 ----A---- C:\Windows\system32\iesetup.dll 2010-01-22 09:19:29 ----A---- C:\Windows\system32\iernonce.dll 2010-01-22 09:19:29 ----A---- C:\Windows\system32\iepeers.dll 2010-01-22 09:19:29 ----A---- C:\Windows\system32\ie4uinit.exe 2010-01-21 13:53:35 ----D---- C:\Program Files\ICQ7.0 2010-01-20 22:43:23 ----D---- C:\Users\michiya\AppData\Roaming\GameInvest 2010-01-14 17:07:25 ----D---- C:\ProgramData\WindowsSearch 2010-01-13 10:50:14 ----A---- C:\Windows\system32\t2embed.dll 2010-01-13 10:50:13 ----A---- C:\Windows\system32\fontsub.dll 2010-01-08 16:17:24 ----D---- C:\Program Files\TrekStor 2010-01-08 14:52:53 ----D---- C:\Windows\Virtual Villagers The Secret City ======List of files/folders modified in the last 1 months====== 2010-02-07 13:33:54 ----D---- C:\Windows\Temp 2010-02-07 13:33:50 ----RD---- C:\Program Files 2010-02-07 13:17:06 ----D---- C:\Windows\System32 2010-02-07 13:17:06 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-02-07 13:17:05 ----D---- C:\Windows\inf 2010-02-06 22:20:27 ----D---- C:\Windows 2010-02-06 14:41:20 ----D---- C:\Windows\system32\catroot2 2010-02-06 14:26:59 ----D---- C:\ProgramData\Spybot - Search & Destroy 2010-02-06 12:51:44 ----D---- C:\Windows\Minidump 2010-02-05 18:06:50 ----HD---- C:\Program Files\InstallShield Installation Information 2010-02-05 16:37:25 ----D---- C:\Windows\schemas 2010-02-05 16:37:24 ----D---- C:\Windows\system32\drivers 2010-02-05 12:56:08 ----HD---- C:\ProgramData 2010-02-05 12:53:03 ----D---- C:\Windows\Debug 2010-02-04 22:07:03 ----D---- C:\Users\michiya\AppData\Roaming\uTorrent 2010-02-04 22:06:18 ----SHD---- C:\Windows\Installer 2010-02-04 22:06:18 ----SHD---- C:\Config.Msi 2010-02-04 22:06:14 ----D---- C:\Windows\system32\Tasks 2010-02-04 22:06:13 ----D---- C:\Program Files\Common Files 2010-02-04 22:06:12 ----D---- C:\ProgramData\Skype 2010-02-04 21:57:03 ----D---- C:\Windows\Tasks 2010-02-04 20:09:25 ----SD---- C:\Users\michiya\AppData\Roaming\Microsoft 2010-02-04 13:36:16 ----A---- C:\Windows\system32\MsiExec.exe.log 2010-02-04 13:34:44 ----RSD---- C:\Windows\assembly 2010-02-04 13:34:43 ----D---- C:\Program Files\Common Files\Nero 2010-02-04 13:34:42 ----D---- C:\ProgramData\Nero 2010-02-04 13:32:52 ----A---- C:\Windows\Irremote.ini 2010-02-04 13:26:30 ----D---- C:\Windows\Prefetch 2010-02-04 11:55:41 ----D---- C:\Program Files\Common Files\Apple 2010-02-03 20:24:09 ----D---- C:\Users\michiya\AppData\Roaming\ICQ 2010-02-03 13:11:07 ----D---- C:\Windows\Microsoft.NET 2010-02-03 13:07:39 ----DC---- C:\Windows\system32\DRVSTORE 2010-02-03 13:07:02 ----D---- C:\Windows\winsxs 2010-02-03 13:06:47 ----SD---- C:\ProgramData\Microsoft 2010-02-03 13:04:53 ----D---- C:\Program Files\Common Files\microsoft shared 2010-02-03 12:51:31 ----D---- C:\Program Files\Microsoft Works 2010-02-03 09:14:59 ----D---- C:\Windows\rescache 2010-02-03 08:54:44 ----D---- C:\Windows\system32\de-DE 2010-02-03 08:53:53 ----D---- C:\Windows\system32\catroot 2010-02-02 19:17:29 ----D---- C:\Program Files\Intel 2010-02-02 19:11:53 ----D---- C:\Program Files\Internet Explorer 2010-02-02 15:57:43 ----A---- C:\Windows\wininit.ini 2010-02-02 13:25:32 ----A---- C:\Windows\NeroDigital.ini 2010-01-30 23:20:36 ----AD---- C:\ProgramData\Temp 2010-01-29 16:14:48 ----D---- C:\ProgramData\Acer GameZone Console 2010-01-23 21:55:03 ----D---- C:\Program Files\Mozilla Firefox 2010-01-23 07:34:18 ----D---- C:\Windows\system32\migration 2010-01-21 13:55:44 ----D---- C:\Program Files\ICQ6Toolbar 2010-01-21 13:55:31 ----D---- C:\ProgramData\ICQ 2010-01-16 17:34:28 ----SHD---- C:\System Volume Information 2010-01-16 17:01:19 ----D---- C:\Program Files\Digital Photo Software 2010-01-16 16:59:20 ----D---- C:\Users\michiya\AppData\Roaming\Real 2010-01-16 16:59:20 ----D---- C:\Program Files\Common Files\Real 2010-01-16 16:45:58 ----D---- C:\temp 2010-01-16 00:54:58 ----D---- C:\Users\michiya\AppData\Roaming\DAEMON Tools Lite 2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe 2010-01-13 23:46:41 ----D---- C:\Program Files\Windows Mail 2010-01-08 20:00:01 ----A---- C:\Windows\tlknw5.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-11-25 23120] R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-11-25 114768] R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-11-25 48560] R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 20112] R1 SbFw;SbFw; C:\Windows\system32\drivers\SbFw.sys [2008-10-31 270888] R1 sbhips;Sunbelt HIPS Driver; C:\Windows\system32\drivers\sbhips.sys [2008-06-21 66600] R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560] R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-11-25 53328] R2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys [2008-08-19 15392] R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672] R2 PSDNServ;PSDNServ; C:\Windows\system32\DRIVERS\PSDNServ.sys [2008-07-29 16944] R2 psdvdisk;PSDVdisk; C:\Windows\system32\DRIVERS\PSDVdisk.sys [2008-07-29 60464] R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-19 8704] R3 ATSWPDRV;AuthenTec TruePrint USB Driver (SwipeSensor); C:\Windows\system32\DRIVERS\ATSwpDrv.sys [2008-05-30 146944] R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208] R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264] R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2008-04-29 54784] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600] R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2008-03-26 980992] R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2008-03-26 207872] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-10-13 2176856] R3 JMCR;JMCR; C:\Windows\system32\DRIVERS\jmcr.sys [2008-09-09 99216] R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E60x86.sys [2009-08-05 48640] R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480] R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2008-01-30 14848] R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2008-09-24 45600] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-10-17 7599072] R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\Windows\system32\DRIVERS\sbfwim.sys [2008-06-21 65576] R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-02-22 198064] R3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016] R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2008-03-26 661504] R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264] S3 avmeject;AVM Eject; C:\Windows\system32\drivers\avmeject.sys [2008-09-05 4352] S3 aw65tmt2;aw65tmt2; C:\Windows\system32\drivers\aw65tmt2.sys [] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632] S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2009-08-05 54632] S3 FWLANUSB;AVM FRITZ!WLAN; C:\Windows\system32\DRIVERS\fwlanusb.sys [2008-09-05 265088] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2008-01-21 200704] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712] R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752] R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680] R2 AVM WLAN Connection Service;AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [2008-09-05 364544] R2 Bonjour Service;Bonjour-Dienst; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384] R2 CLHNService;CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-10-04 69632] R2 eDataSecurity Service;eDataSecurity Service; C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2008-07-29 500784] R2 ETService;Empowering Technology Service; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [2008-08-19 24576] R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2008-10-16 860160] R2 IGBASVC;iGroupTec Service; C:\Program Files\Acer\Acer Bio Protection\BASVC.exe [2008-10-14 3602432] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440] R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2007-12-06 110592] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-25 45056] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-25 131072] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-10-17 203296] R2 O&O Defrag;O&O Defrag; C:\Windows\system32\oodag.exe [2005-05-11 225280] R2 OOCleverCacheAgent;O&O CleverCache Agent; C:\Program Files\OO Software\CleverCache\ooccag.exe [2005-11-09 147968] R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2008-10-16 466944] R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\Cyberlink\Shared files\RichVideo.exe [2007-01-09 272024] R2 RS_Service;Raw Socket Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [2008-01-10 233472] R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528] R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512] R2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288] R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-19 386560] R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392] R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040] R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920] R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-01-22 545576] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504] S3 fsssvc;Windows Live Family Safety-Dienst; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864] -----------------EOF----------------- |
09.02.2010, 22:34 | #4 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Bitte mal den Avenger anwenden 1.) Lade Dir von hier Avenger: Swandog46's Public Anti-Malware Tools (Download, linksseitig) 2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen: 3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld: Code:
ATTFilter files to delete: C:\Users\michiya\Downloads\sriiedv.exe C:\Windows\system32\ShellManager310E2D762.dll C:\Windows\tlknw5.ini 5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein. 6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso. 7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.
__________________ Logfiles bitte immer in CODE-Tags posten |
09.02.2010, 22:58 | #5 |
| Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Hi, ich habe das gerade gemacht. Hier das Log Logfile of The Avenger Version 2.0, (c) by Swandog46 Swandog46's Public Anti-Malware Tools Platform: Windows Vista ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: file "C:\Users\michiya\Downloads\sriiedv.exe" not found! Deletion of file "C:\Users\michiya\Downloads\sriiedv.exe" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "C:\Windows\system32\ShellManager310E2D762.dll" deleted successfully. File "C:\Windows\tlknw5.ini" deleted successfully. Completed script processing. ******************* Finished! Terminate. |
09.02.2010, 23:29 | #6 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Probier jetzt mal bitte den Durchgang mit Malwarebytes. Auch wenn es so normal startet, bitte nach dieser Anleitung hin umbenennen => http://www.trojaner-board.de/82699-m...tet-nicht.html
__________________ --> Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet |
10.02.2010, 13:24 | #7 |
| Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Habe ich gemacht. Allerdings musste ich Malwarebytes zweimal durchlaufen lassen weil nach 20 min mit dem bekannten Problem der Laptop wieder runterfuhr. Insgsammt hat Malwarebytes noch einiges gefunden, nachdem es dann beim zweiten Mal durchlief ohne Probleme. Soll ich die Logs davon reinstellen ? |
10.02.2010, 18:15 | #8 |
| Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Ok Problem hat sich behoben, war wohl ein kleines Aufbegehren beim vernichten. Läuft alles wieder wie es soll, danke schön |
11.02.2010, 18:22 | #9 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet Poste trotzdem bitte alle Log, denn wir müssen wissen, was MBAM da so gefunden hat.
__________________ Logfiles bitte immer in CODE-Tags posten |
Themen zu Reboot nach Dcom Server Prozessorstart wurde unerwartet beendet |
abgesicherten, abgesicherten modus, antivirus, avast, avast antivirus, beendet, destroy, fehlermeldung, gelöscht, gestern, heute, laptop, laufen, maximal, modus, neu, problem, reboot, recovery, recovery cd, runter, search, server, spybot, spybot search and destroy, stunden, trojaner, vista, was tun, zu heiß, zwei trojaner |