| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: habe einen virus brauche eure hilfeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
06.06.2011, 14:28
| #1 |
 |  habe einen virus brauche eure hilfe ich habe ein virus auf meinen pc bekommen , da habe ich mit avira kompletter check gemacht aber er kamm immer wieder zurück habe mich dan endschieden system neu zu machen. naturlich habe ich alles formatiert und partitionen gelöcht für neu zu partitionieren beim hoch fahren habe ich erst mal den antivirus draufgezogen und überaschung der virus ist immer noch da....... HILFE habe ein par infos noch Name: BOO/TDss.M Art: Boot Sector Virus (de) In freier Wildbahn: Ja Gemeldete Infektionen: Niedrig Verbreitungspotenzial: Niedrig Schadenspotenzial: Niedrig Statische Datei: Ja Dateigröße: 512 Bytes MD5 Prüfsumme: e150aa222b36a35132cc917c79ed87d1 Allgemein Verbreitungsmethode: • Keine eigene Verbreitungsroutine Aliases: • Kaspersky: Rootkit.Win32.TDSS.mbr • F-Secure: Rootkit.Win32.TDSS.mbr • Bitdefender: Rootkit.MBR.TDSS.B • Avast: Alureon-G@mbr • Microsoft: Trojan  OS/Alureon.A • AVG: Win32/Alureon.MBR • Grisoft: Win32/Alureon.MBR • DrWeb: BackDoor.Tdss.4005 • Norman: TDSSmbr.A Betriebsysteme: • Windows 98 • Windows 98 SE • Windows NT • Windows ME • Windows 2000 • Windows XP • Windows 2003 • Windows Vista • Windows Server 2008 • Windows 7 jetz die otl extra text datei OTL Extras logfile created on: 06.06.2011 15:07:16 - Run 1 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\ktenking\Desktop Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 2,44 Gb Available Physical Memory | 69,72% Memory free 7,00 Gb Paging File | 5,73 Gb Available in Paging File | 81,97% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 220,88 Gb Free Space | 94,85% Space Free | Partition Type: NTFS Drive D: | 232,79 Gb Total Space | 232,69 Gb Free Space | 99,96% Space Free | Partition Type: NTFS Drive F: | 2,25 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: KTENKING-PC | User Name: ktenking | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "Avira AntiVir Desktop" = Avira AntiVir Premium ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 06.06.2011 08:49:01 | Computer Name = ktenking-PC | Source = WinMgmt | ID = 10 Description = Error - 06.06.2011 08:56:11 | Computer Name = ktenking-PC | Source = SideBySide | ID = 16842785 Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\ktenking\AppData\Local\Temp\avnwldrtemp\setup\redist.dll". Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". < End of report > otl report OTL logfile created on: 06.06.2011 15:07:16 - Run 1 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\ktenking\Desktop Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 2,44 Gb Available Physical Memory | 69,72% Memory free 7,00 Gb Paging File | 5,73 Gb Available in Paging File | 81,97% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 232,88 Gb Total Space | 220,88 Gb Free Space | 94,85% Space Free | Partition Type: NTFS Drive D: | 232,79 Gb Total Space | 232,69 Gb Free Space | 99,96% Space Free | Partition Type: NTFS Drive F: | 2,25 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: KTENKING-PC | User Name: ktenking | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.06.06 15:06:41 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\ktenking\Desktop\OTL.exe PRC - [2011.06.06 15:04:42 | 000,050,477 | ---- | M] () -- C:\Users\ktenking\Desktop\Defogger.exe PRC - [2011.06.06 14:56:00 | 000,667,304 | ---- | M] (Avira GmbH) -- C:\Users\ktenking\AppData\Local\Temp\avnwldrtemp\setup\setup.exe PRC - [2011.06.06 14:56:00 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.06.06 14:55:59 | 000,588,456 | ---- | M] (Avira GmbH) -- C:\Users\ktenking\AppData\Local\Temp\avnwldrtemp\setup\presetup.exe PRC - [2011.06.06 14:55:48 | 000,421,032 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2011.06.06 14:55:47 | 000,442,024 | ---- | M] (Avira GmbH) -- c:\Programme\Avira\AntiVir Desktop\avscan.exe PRC - [2011.06.06 14:55:47 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.06.06 14:55:46 | 000,223,912 | ---- | M] (Avira GmbH) -- c:\Programme\Avira\AntiVir Desktop\avnotify.exe PRC - [2011.06.06 14:55:45 | 000,339,624 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe PRC - [2011.06.06 14:55:45 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.06 14:55:44 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.06.06 14:55:43 | 000,389,288 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avcenter.exe PRC - [2011.06.06 14:55:43 | 000,361,128 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avconfig.exe PRC - [2011.06.06 14:54:28 | 000,825,048 | ---- | M] () -- C:\Users\ktenking\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SIYKXAD\avira_antivir_premium[1].exe PRC - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 23:29:33 | 000,673,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe PRC - [2010.11.20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.11.20 23:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.11.20 23:29:10 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2010.03.02 16:42:32 | 000,214,184 | ---- | M] (Avira GmbH) -- C:\Users\ktenking\AppData\Local\Temp\RarSFX0\avwebloader.exe ========== Modules (SafeList) ========== MOD - [2011.06.06 15:06:41 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\ktenking\Desktop\OTL.exe MOD - [2010.11.20 23:29:06 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2011.06.06 14:56:00 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.06.06 14:55:48 | 000,421,032 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2011.06.06 14:55:45 | 000,339,624 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2011.06.06 14:55:45 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2011.06.06 14:56:10 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.06.06 14:56:10 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.06.06 14:56:10 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.11.20 23:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 23:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\tsusbhub.sys -- (tsusbhub) DRV - [2010.11.20 23:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\Synth3dVsc.sys -- (Synth3dVsc) DRV - [2010.11.20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\dmvsc.sys -- (dmvsc) DRV - [2010.11.20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2010.11.20 23:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\terminpt.sys -- (terminpt) DRV - [2010.11.20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap) DRV - [2009.06.10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 76 A3 6B 42 48 24 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.11.21 02:25:07 | 000,000,043 | R--- | M] () - F:\autorun.inf -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.06.06 15:06:40 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\ktenking\Desktop\OTL.exe [2011.06.06 14:57:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.06.06 14:57:28 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.06.06 14:57:28 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.06.06 14:57:28 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.06.06 14:57:28 | 000,000,000 | ---D | C] -- C:\Programme\Avira [2011.06.06 14:57:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.06.06 14:56:13 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2011.06.06 14:49:39 | 000,000,000 | R--D | C] -- C:\Users\ktenking\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.06.06 14:49:39 | 000,000,000 | R--D | C] -- C:\Users\ktenking\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.06.06 14:49:38 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Searches [2011.06.06 14:49:30 | 000,000,000 | ---D | C] -- C:\Users\ktenking\AppData\Roaming\Identities [2011.06.06 14:49:27 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Contacts [2011.06.06 14:49:19 | 000,000,000 | ---D | C] -- C:\Users\ktenking\AppData\Local\VirtualStore [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Vorlagen [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\AppData\Local\Verlauf [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\AppData\Local\Temporary Internet Files [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Startmenü [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\SendTo [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Recent [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Netzwerkumgebung [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Lokale Einstellungen [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Documents\Eigene Videos [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Documents\Eigene Musik [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Eigene Dateien [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Documents\Eigene Bilder [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Druckumgebung [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Cookies [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\AppData\Local\Anwendungsdaten [2011.06.06 14:49:18 | 000,000,000 | -HSD | C] -- C:\Users\ktenking\Anwendungsdaten [2011.06.06 14:49:18 | 000,000,000 | ---D | C] -- C:\Users\ktenking\AppData\Local\Temp [2011.06.06 14:49:18 | 000,000,000 | ---D | C] -- C:\Users\ktenking\AppData\Local\Microsoft [2011.06.06 14:49:18 | 000,000,000 | ---D | C] -- C:\Users\ktenking\AppData\Roaming\Media Center Programs [2011.06.06 14:49:17 | 000,000,000 | --SD | C] -- C:\Users\ktenking\AppData\Roaming\Microsoft [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Videos [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Saved Games [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Pictures [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Music [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Links [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Favorites [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Downloads [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Documents [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\Desktop [2011.06.06 14:49:17 | 000,000,000 | R--D | C] -- C:\Users\ktenking\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.06.06 14:49:17 | 000,000,000 | -H-D | C] -- C:\Users\ktenking\AppData [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\Recovery [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\Programme [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\Desktop [2011.06.06 14:49:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.06.06 14:49:01 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2011.06.06 14:40:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Hewlett-Packard [2011.06.06 14:38:55 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2011.06.06 14:38:52 | 000,000,000 | ---D | C] -- C:\Windows\CSC ========== Files - Modified Within 30 Days ========== [2011.06.06 15:06:41 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\ktenking\Desktop\OTL.exe [2011.06.06 15:05:01 | 000,000,000 | ---- | M] () -- C:\Users\ktenking\defogger_reenable [2011.06.06 15:04:42 | 000,050,477 | ---- | M] () -- C:\Users\ktenking\Desktop\Defogger.exe [2011.06.06 14:57:33 | 000,002,016 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.06.06 14:56:10 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.06.06 14:56:10 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.06.06 14:56:10 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.06.06 14:53:15 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.06.06 14:53:15 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.06.06 14:53:15 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.06.06 14:53:15 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.06.06 14:41:54 | 000,016,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.06.06 14:41:54 | 000,016,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.06.06 14:41:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.06.06 14:41:25 | 2817,384,448 | -HS- | M] () -- C:\hiberfil.sys [2011.06.06 14:40:47 | 000,000,771 | ---- | M] () -- C:\Windows\System32\license.rtf ========== Files Created - No Company Name ========== [2011.06.06 15:05:01 | 000,000,000 | ---- | C] () -- C:\Users\ktenking\defogger_reenable [2011.06.06 15:04:42 | 000,050,477 | ---- | C] () -- C:\Users\ktenking\Desktop\Defogger.exe [2011.06.06 14:57:33 | 000,002,016 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011.06.06 14:49:39 | 000,001,413 | ---- | C] () -- C:\Users\ktenking\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.06.06 14:38:27 | 2817,384,448 | -HS- | C] () -- C:\hiberfil.sys [2010.11.21 02:30:51 | 000,643,628 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2010.11.21 02:30:51 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2010.11.21 02:30:51 | 000,126,188 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2010.11.21 02:30:51 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2010.11.20 23:29:34 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2010.11.20 23:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 06:33:53 | 000,265,640 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 04:05:48 | 000,606,992 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 04:05:48 | 000,103,370 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 02:55:09 | 001,332,736 | ---- | C] () -- C:\Windows\System32\hpotiop1.dll [2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat < End of report > gmerbericht GMER 1.0.15.15640 - hxxp://www.gmer.net Rootkit quick scan 2011-06-06 15:17:00 Windows 6.1.7601 Service Pack 1 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD250HJ rev.FH100-05 Running: dzipq2db.exe; Driver: C:\Users\ktenking\AppData\Local\Temp\uxdyrkog.sys ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk1\DR1 TDL4@MBR code has been found <-- ROOTKIT !!! ---- EOF - GMER 1.0.15 ---- defrogger_disable defogger_disable by jpshortstuff (23.02.10.1) Log created at 15:06 on 06/06/2011 (ktenking) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- |
| Themen zu habe einen virus brauche eure hilfe |
| antivirus, autorun, avast, avg, avira, boo/tdss.m, defender, error, explorer, fehler, install.exe, kaspersky, langs, logfile, nicht gefunden, norman, nvidia, nvlddmkm.sys, oldtimer, rarsfx0, registry, rundll, scan, security, server, shell32.dll, software, start menu, system, system neu, temp, trojan, virus, virus eingefangen, webcheck, windows |
Baum-Darstellung