| |
| |||||||
Log-Analyse und Auswertung: Windows Delayed Write File, auch bei mir!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
08.11.2011, 15:38
| #16 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Windows Delayed Write File, auch bei mir! Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
08.11.2011, 16:28
| #17 |
 | Windows Delayed Write File, auch bei mir! Combofix Logfile:
__________________Code:
ATTFilter ComboFix 11-11-08.02 - Lisa 08.11.2011 16:14:11.1.4 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3071.2045 [GMT 1:00]
ausgeführt von:: c:\users\Lisa\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Lisa\AppData\Local\ntucbvxr.log
c:\users\Lisa\AppData\Local\wcywwkcj.log
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-10-08 bis 2011-11-08 ))))))))))))))))))))))))))))))
.
.
2011-11-08 15:18 . 2011-11-08 15:18 -------- d-----w- c:\users\Lisa\AppData\Local\temp
2011-11-08 15:18 . 2011-11-08 15:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-11-08 13:58 . 2011-11-08 13:58 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F18231E8-61FC-456F-9229-A26A8A2679DE}\offreg.dll
2011-11-08 13:54 . 2011-11-08 13:54 -------- d-----w- C:\_OTL
2011-11-08 08:43 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F18231E8-61FC-456F-9229-A26A8A2679DE}\mpengine.dll
2011-11-07 14:43 . 2011-11-07 14:43 -------- d-----w- c:\program files\ESET
2011-11-07 10:11 . 2011-11-07 10:11 -------- d-----w- c:\users\Lisa\AppData\Roaming\Malwarebytes
2011-11-07 10:11 . 2011-11-07 10:11 -------- d-----w- c:\programdata\Malwarebytes
2011-11-07 10:10 . 2011-11-07 10:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-07 10:10 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-07 10:01 . 2011-11-08 13:55 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-11-07 10:01 . 2011-11-07 10:04 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-11-07 09:41 . 2011-11-07 10:03 -------- d-----w- c:\programdata\PC Tools
2011-10-26 10:46 . 2011-08-15 04:25 6144 ----a-w- c:\program files\Internet Explorer\iecompat.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-07 10:33 . 2009-03-30 14:30 564632 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2011-11-07 10:33 . 2009-03-30 14:20 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-06-07 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-10-19 02:12 1983816 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2009-09-04 01:43 767312 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-18 17:52 104936 ----a-w- c:\program files\CyberLink\Power2Go\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Feeds]
2009-08-18 12:22 993 ----a-w- c:\windows\System32\oobe\info\FEEDS.bat.lnk
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IJNetworkScanUtility]
2009-05-19 16:11 136544 ----a-w- c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexwareInfoService]
2008-11-03 12:21 339240 ----a-w- c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2008-12-02 20:39 3882312 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-07-23 00:43 13797920 ----a-w- c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2009-07-20 17:21 7625248 ----a-w- c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-07 135664]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-07 135664]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-01-15 721904]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 netr28u;RT2870-USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-26 66080]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 92682316
*Deregistered* - 92682316
*Deregistered* - afw
*Deregistered* - afwcore
*Deregistered* - BdFileSpy
.
Inhalt des "geplante Tasks" Ordners
.
2011-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-07 15:17]
.
2011-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-07 15:17]
.
2011-11-08 c:\windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
- c:\windows\system32\msfeedssync.exe [2011-10-15 04:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{D0A5FA8B-7078-4342-9769-98D82699E0D9}: NameServer = 192.168.2.1,192.168.2.20
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-AlSrvN - i:\verschiedenes\alco\Alcohol 120% v.1.9.8.7612 Retail\patch\Plugins\Helper\AlSrvN.exe
AddRemove-_{E1A63F75-1F72-4450-980D-434496FFC646} - c:\program files\Corel\Corel Painter Essentials 4\MSILauncher {E1A63F75-1F72-4450-980D-434496FFC646}
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-11-08 16:19:27
ComboFix-quarantined-files.txt 2011-11-08 15:19
.
Vor Suchlauf: 11 Verzeichnis(se), 452.623.949.824 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 452.531.945.472 Bytes frei
.
- - End Of File - - 90F3C91AAB3413C21175853EF567AACC
|
|
08.11.2011, 19:37
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Delayed Write File, auch bei mir! Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
__________________GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).
__________________ |
|
09.11.2011, 07:32
| #19 |
| | Windows Delayed Write File, auch bei mir! GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-11-09 00:06:26
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\0000005e WDC_WD64 rev.05.0
Running: cytcz5ll.exe; Driver: C:\Users\Lisa\AppData\Local\Temp\pwldapow.sys
---- System - GMER 1.0.15 ----
SSDT 999F9E6E ZwCreateSection
SSDT 999F9E78 ZwRequestWaitReplyPort
SSDT 999F9E73 ZwSetContextThread
SSDT 999F9E7D ZwSetSecurityObject
SSDT 999F9E82 ZwSystemDebugControl
SSDT 999F9E0F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKey + 13D1 8308E349 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 830C7D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 830CEEAC 4 Bytes [6E, 9E, 9F, 99] {OUTSB ; SAHF ; LAHF ; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 830CF208 4 Bytes [78, 9E, 9F, 99] {JS 0xffffffffffffffa0; LAHF ; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 830CF24C 4 Bytes [73, 9E, 9F, 99] {JAE 0xffffffffffffffa0; LAHF ; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 830CF2C8 4 Bytes [7D, 9E, 9F, 99] {JGE 0xffffffffffffffa0; LAHF ; CDQ }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 830CF31C 4 Bytes [82, 9E, 9F, 99]
.text ...
? System32\Drivers\splg.sys Das System kann den angegebenen Pfad nicht finden. !
.text USBPORT.SYS!DllUnload 94A5CDB9 5 Bytes JMP 8717C1D8
.text autochk.exe 004111D1 3 Bytes [44, 12, 41]
.text autochk.exe 004111D5 2 Bytes [8D, 49]
.text autochk.exe 004111D8 3 Bytes [3B, 12, 41] {CMP EDX, [EDX]; INC ECX}
.text autochk.exe 004111DC 3 Bytes [28, 12, 41] {SUB [EDX], DL; INC ECX}
.text autochk.exe 004111E0 3 Bytes [20, 12, 41] {AND [EDX], DL; INC ECX}
.text ...
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 859801F8
Device \FileSystem\fastfat \FatCdrom 871941F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{3B026508-9DE9-427C-8F40-967A6F03D1A7} 87146380
Device \Driver\volmgr \Device\VolMgrControl 8597C1F8
Device \Driver\usbohci \Device\USBPDO-0 8717D1F8
Device \Driver\usbehci \Device\USBPDO-1 8717E1F8
Device \Driver\ACPI_HAL \Device\00000046 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
Device \Driver\USBSTOR \Device\00000070 87B7E1F8
Device \Driver\volmgr \Device\HarddiskVolume1 8597C1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\USBSTOR \Device\00000071 87B7E1F8
Device \Driver\cdrom \Device\CdRom0 86EC61F8
Device \Driver\volmgr \Device\HarddiskVolume2 8597C1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\NetBT \Device\NetBT_Tcpip_{D0A5FA8B-7078-4342-9769-98D82699E0D9} 87146380
Device \Driver\volmgr \Device\HarddiskVolume3 8597C1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\volmgr \Device\HarddiskVolume4 8597C1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\volmgr \Device\HarddiskVolume5 8597C1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\NetBT \Device\NetBt_Wins_Export 87146380
Device \Driver\nvstor32 \Device\RaidPort0 8597E1F8
Device \Driver\nvstor32 \Device\0000005e 8597E1F8
Device \Driver\nvstor32 \Device\0000005f 8597E1F8
Device \Driver\usbohci \Device\USBFDO-0 8717D1F8
Device \Driver\usbehci \Device\USBFDO-1 8717E1F8
Device \Driver\USBSTOR \Device\0000006e 87B7E1F8
Device \Driver\USBSTOR \Device\0000006f 87B7E1F8
Device \FileSystem\fastfat \Fat 871941F8
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xB0 0xE8 0x95 0x2C ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xB0 0xE8 0x95 0x2C ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_de-de_5f011d1ddf01ba64\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..-platform.resources_31bf3856ad364e35_de-de_86be3684ae6de33a\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..converter.resources_31bf3856ad364e35_de-de_d9035f0c6061afb4\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..favorites.resources_31bf3856ad364e35_de-de_ae31531342a7d429\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..filercore.resources_31bf3856ad364e35_de-de_24a30d6ac0ed23b0\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_de-de_9b3b9375d9eea4fb\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_de-de_aa660d7de25496b1\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..kitengine.resources_31bf3856ad364e35_de-de_695a8d7c366e879c\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..mlediting.resources_31bf3856ad364e35_de-de_16e0553d3bcdd7d0\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..mlrenderingadvanced_31bf3856ad364e35_none_26ef327d5e5adff8\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..mostfiles.resources_31bf3856ad364e35_de-de_c509db01ec4a9778\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..ngsupport.resources_31bf3856ad364e35_de-de_3f8c720723a4f0bf\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..onmanager.resources_31bf3856ad364e35_de-de_98281728e1772c1f\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..otmailapi.resources_31bf3856ad364e35_de-de_0b71aae7f069d855\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_de-de_7d52f459db0bc34e\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_de-de_7f179d2be190eff2\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_de-de_a1d37c990670c285\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..p-support.resources_31bf3856ad364e35_de-de_dfa9a14d284f29fa\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..plication.resources_31bf3856ad364e35_de-de_7e0769554c1b4ed2\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..ptdebugui.resources_31bf3856ad364e35_de-de_401f845503cdee95\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..rationkit.resources_31bf3856ad364e35_de-de_ece57c9b118bb2bf\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..rendering.resources_31bf3856ad364e35_de-de_17c30563dbad0c7a\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..rofilerui.resources_31bf3856ad364e35_de-de_1d9e5193147991a3\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..rolviewer.resources_31bf3856ad364e35_de-de_ad3d5b80c71966ab\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..shooters-deployment_31bf3856ad364e35_none_8f95003e171fb555\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..tacontrol.resources_31bf3856ad364e35_de-de_e9c502d8592f1538\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..tbranding.resources_31bf3856ad364e35_de-de_e79e19bbf7b20ef7\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_de-de_68d7b3f260dc21c3\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..tivexpolicyprovider_31bf3856ad364e35_none_c2e4bdf9f1fe7d2e\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_de-de_3f1e0ed71797d3e9\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-behaviors.resources_31bf3856ad364e35_de-de_7c1cc4dfac883e46\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-controls.resources_31bf3856ad364e35_de-de_d52b7cf600837cbb\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-devtools.resources_31bf3856ad364e35_de-de_049880dfacb9aed1\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_de-de_ff3f447b8b24e9ef\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-hotmailapi_31bf3856ad364e35_none_8acd733064861df5\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-iecompat_31bf3856ad364e35_none_c46f7eb4833127d9\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-ielowutil.resources_31bf3856ad364e35_de-de_d3861e5d0b2ca97f\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_de-de_243a1b499f137c1a\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-infocard.resources_31bf3856ad364e35_de-de_49d5c59c746093f3\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ie-setup.resources_31bf3856ad364e35_de-de_07f4766f36ae290c\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-iebrowsewebdiagnostic_31bf3856ad364e35_none_58ac123660069603\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ieframe.resources_31bf3856ad364e35_de-de_de4d1b121a895c5f\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-ieinstal.resources_31bf3856ad364e35_de-de_91098af0a1f474cb\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-iesecuritydiagnostic_31bf3856ad364e35_none_12b25670dd18b59f\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-inetres-adm.resources_31bf3856ad364e35_de-de_32dde5ef0700ba67\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-j..buggeride.resources_31bf3856ad364e35_de-de_7b84a8e020173b71\8.0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-l2gpstore.resources_31bf3856ad364e35_de-de_959c6e6fa132351c\6.1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\x86_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_de-de_cd6c2fc6b0ad5b21\8.0
---- Files - GMER 1.0.15 ----
File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0026D.log 1048576 bytes
---- EOF - GMER 1.0.15 ----
|
|
09.11.2011, 07:33
| #20 |
| | Windows Delayed Write File, auch bei mir! OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 07:31:43 on 09.11.2011 OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "bdeadmin.cpl" - ? - C:\Windows\system32\bdeadmin.cpl "FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl "nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl "PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal - Free Antivirus " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys "catchme" (catchme) - ? - C:\Users\Lisa\AppData\Local\Temp\catchme.sys (File not found) "sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys (File is exclusively opened, access blocked) "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {DE902992-61FC-4A01-8091-53E1895C9775} "CDR Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll {7AD101F2-0B93-4D66-A1CA-DF73F3C4377B} "CDR preview provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll {7FA63AC0-F5BC-4F3B-A9CF-94328D812B62} "CDR Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll {1462EBAA-96E7-4D93-9A66-0E4068DE4FCF} "CDR Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll {DE902994-61FC-4A01-8091-53E1895C9775} "CMX Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll {1462EBAC-96E7-4D93-9A66-0E4068DE4FCF} "CMX Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {DE902993-61FC-4A01-8091-53E1895C9775} "CPT Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll {7FA63AC1-F5BC-4F3B-A9CF-94328D812B62} "CPT Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll {1462EBAB-96E7-4D93-9A66-0E4068DE4FCF} "CPT Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {21347690-EC41-4F9A-8887-1F4AEE672439} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 (HTTP value) -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll <binary data> "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll <binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )----- {472734EA-242A-422b-ADF8-83D1E48CC825} "{472734EA-242A-422b-ADF8-83D1E48CC825}" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab {7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab {17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? - (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 (HTTP value) {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} "Canon Easy-WebPrint EX" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll <binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} "Canon Easy-WebPrint EX BHO" - "CANON INC." - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Canon BJNP Port" - "CANON INC." - C:\Windows\system32\CNMNPPM.DLL "Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe "Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE "McAfee Security Scan Component Host Service" (McComponentHostService) - "McAfee, Inc." - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe "ProtexisLicensing" (ProtexisLicensing) - ? - C:\Windows\system32\PSIService.exe "SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe "Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
09.11.2011, 09:03
| #21 |
| | Windows Delayed Write File, auch bei mir! aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software Run date: 2011-11-09 08:37:55 ----------------------------- 08:37:55.056 OS Version: Windows 6.1.7601 Service Pack 1 08:37:55.056 Number of processors: 4 586 0x170A 08:37:55.056 ComputerName: LISA-PC UserName: Lisa 08:38:15.363 Initialize success 08:38:50.650 AVAST engine defs: 11110802 08:38:57.670 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005e 08:38:57.670 Disk 0 Vendor: WDC_WD64 05.0 Size: 610480MB BusType: 3 08:38:59.682 Disk 0 MBR read successfully 08:38:59.682 Disk 0 MBR scan 08:38:59.682 Disk 0 Windows 7 default MBR code 08:38:59.682 Disk 0 scanning sectors +1250260992 08:38:59.745 Disk 0 scanning C:\Windows\system32\drivers 08:39:09.245 Service scanning 08:39:09.791 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32 08:39:10.353 Modules scanning 08:39:17.279 Disk 0 trace - called modules: 08:39:17.295 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x8597e1f8]<< 08:39:17.295 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x866a3550] 08:39:17.310 3 CLASSPNP.SYS[8bd0a59e] -> nt!IofCallDriver -> [0x8670f900] 08:39:17.310 5 ACPI.sys[837bf3d4] -> nt!IofCallDriver -> \Device\0000005e[0x8683a030] 08:39:17.310 \Driver\nvstor32[0x866f7db8] -> IRP_MJ_CREATE -> 0x8597e1f8 08:39:18.574 AVAST engine scan C:\Windows 08:39:24.128 AVAST engine scan C:\Windows\system32 08:41:35.542 AVAST engine scan C:\Windows\system32\drivers 08:41:44.902 AVAST engine scan C:\Users\Lisa 08:47:32.595 AVAST engine scan C:\ProgramData 08:49:13.059 Scan finished successfully 09:01:15.526 Disk 0 MBR has been saved successfully to "C:\Users\Lisa\Documents\MBR.dat" 09:01:15.542 The log file has been saved successfully to "C:\Users\Lisa\Documents\aswMBR.txt" |
|
09.11.2011, 10:07
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Delayed Write File, auch bei mir! Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.11.2011, 10:25
| #23 |
| | Windows Delayed Write File, auch bei mir! Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8122 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 09.11.2011 10:21:55 mbam-log-2011-11-09 (10-21-55).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 161273 Laufzeit: 2 Minute(n), 52 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
09.11.2011, 10:34
| #24 |
| | Windows Delayed Write File, auch bei mir! SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 11/09/2011 at 10:30 AM Application Version : 5.0.1134 Core Rules Database Version : 7917 Trace Rules Database Version: 5729 Scan type : Quick Scan Total Scan Time : 00:02:52 Operating System Information Windows 7 Home Premium 32-bit, Service Pack 1 (Build 6.01.7601) UAC On - Limited User Memory items scanned : 528 Memory threats detected : 0 Registry items scanned : 30075 Registry threats detected : 0 File items scanned : 7292 File threats detected : 4 Adware.Tracking Cookie C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\lisa@stat.aldi[1].txt [ /stat.aldi ] C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\lisa@stat.aldi[2].txt [ /stat.aldi ] C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\4Z38BIY7.txt [ /im.banner.t-online.de ] C:\USERS\LISA\Cookies\4Z38BIY7.txt [ Cookie:lisa@im.banner.t-online.de/ ] |
|
09.11.2011, 11:02
| #25 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Delayed Write File, auch bei mir!Zitat:
Denk dran vorher die Signaturen von Malwarebytes zu aktualisieren, da gibt es sehr häufig neue Updates!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.11.2011, 14:52
| #26 |
| | Windows Delayed Write File, auch bei mir! Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8122 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 09.11.2011 12:28:05 mbam-log-2011-11-09 (12-28-05).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 381221 Laufzeit: 1 Stunde(n), 1 Minute(n), 43 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
09.11.2011, 15:47
| #27 |
| | Windows Delayed Write File, auch bei mir! SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 11/09/2011 at 03:32 PM Application Version : 5.0.1134 Core Rules Database Version : 7917 Trace Rules Database Version: 5729 Scan type : Complete Scan Total Scan Time : 00:39:27 Operating System Information Windows 7 Home Premium 32-bit, Service Pack 1 (Build 6.01.7601) UAC On - Limited User Memory items scanned : 532 Memory threats detected : 0 Registry items scanned : 38342 Registry threats detected : 0 File items scanned : 71687 File threats detected : 28 Adware.Tracking Cookie C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\LRS95R7I.txt [ /im.banner.t-online.de ] C:\USERS\LISA\Cookies\LRS95R7I.txt [ Cookie:lisa@im.banner.t-online.de/ ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@BS.SERVING-SYS[2].TXT [ /BS.SERVING-SYS ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@2O7[1].TXT [ /2O7 ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@ADFARM1.ADITION[1].TXT [ /ADFARM1.ADITION ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@APMEBF[1].TXT [ /APMEBF ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@ATDMT[2].TXT [ /ATDMT ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@BS.SERVING-SYS[1].TXT [ /BS.SERVING-SYS ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@BS.SERVING-SYS[3].TXT [ /BS.SERVING-SYS ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@DOUBLECLICK[1].TXT [ /DOUBLECLICK ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@DOUBLECLICK[2].TXT [ /DOUBLECLICK ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@HOMEPORNON[1].TXT [ /HOMEPORNON ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@HOMEPORNON[2].TXT [ /HOMEPORNON ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@IM.BANNER.T-ONLINE[2].TXT [ /IM.BANNER.T-ONLINE ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@MEDIAPLEX[2].TXT [ /MEDIAPLEX ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@MEDIATHEK.DASERSTE[2].TXT [ /MEDIATHEK.DASERSTE ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@TRACKING.QUISMA[1].TXT [ /TRACKING.QUISMA ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@TRACKING.QUISMA[2].TXT [ /TRACKING.QUISMA ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@TRAFFICTRACK[2].TXT [ /TRAFFICTRACK ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@WWW.GOOGLEADSERVICES[1].TXT [ /WWW.GOOGLEADSERVICES ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@XITI[1].TXT [ /XITI ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@XITI[2].TXT [ /XITI ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@XITI[3].TXT [ /XITI ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@XITI[4].TXT [ /XITI ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@ZANOX-AFFILIATE[1].TXT [ /ZANOX-AFFILIATE ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@ZANOX[1].TXT [ /ZANOX ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@ZANOX[2].TXT [ /ZANOX ] C:\USERS\LISA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\LISA@ZANOX[3].TXT [ /ZANOX ] |
|
09.11.2011, 22:29
| #28 |
| | Windows Delayed Write File, auch bei mir! ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK esets_scanner_update returned -1 esets_gle=53251 # version=7 # iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=4bcf6368b39ad643bc772529f6cf3712 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-08 10:15:26 # local_time=2011-11-08 11:15:26 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=5893 16776573 100 94 5122 73182074 0 0 # compatibility_mode=8192 67108863 100 0 69935 69935 0 0 # scanned=233087 # found=4 # cleaned=0 # scan_time=4016 C:\Users\Lisa\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\f9b2235-31bba2f6 a variant of Win32/Kryptik.VAQ trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Lisa\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\f9b2235-7850b3f7 a variant of Win32/Kryptik.VAQ trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Lisa\Downloads\photoscape.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I ${Memory} probably a variant of Win32/Ramnit.L virus 00000000000000000000000000000000 I # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=4bcf6368b39ad643bc772529f6cf3712 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-09 10:25:47 # local_time=2011-11-09 11:25:47 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 68490 68490 0 0 # compatibility_mode=5893 16776574 100 94 45446 72462788 0 0 # compatibility_mode=8192 67108863 100 0 158201 158201 0 0 # scanned=101478 # found=0 # cleaned=0 # scan_time=2749 # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=4bcf6368b39ad643bc772529f6cf3712 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-09 04:54:17 # local_time=2011-11-09 05:54:17 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 87290 87290 0 0 # compatibility_mode=5893 16776574 100 94 64246 72481588 0 0 # compatibility_mode=8192 67108863 100 0 177001 177001 0 0 # scanned=231202 # found=1 # cleaned=0 # scan_time=7280 C:\Users\Lisa\Downloads\photoscape.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=4bcf6368b39ad643bc772529f6cf3712 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-09 09:28:29 # local_time=2011-11-09 10:28:29 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 111000 111000 0 0 # compatibility_mode=5893 16776574 100 94 87956 72505298 0 0 # compatibility_mode=8192 67108863 100 0 200711 200711 0 0 # scanned=138 # found=0 # cleaned=0 # scan_time=2 |
|
10.11.2011, 11:28
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows Delayed Write File, auch bei mir! Sieht ok aus, da wurden nur Cookies gefunden. Noch Probleme oder weitere Funde in der Zwischenzeit?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.11.2011, 22:38
| #30 |
| | Windows Delayed Write File, auch bei mir! Scheint alles Dank Deiner tollen Hilfe wieder zu funktionieren! Hier nochmal der Malwarebytes log: Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8132 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 10.11.2011 18:49:05 mbam-log-2011-11-10 (18-49-05).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 378467 Laufzeit: 1 Stunde(n), 1 Minute(n), 31 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
| Themen zu Windows Delayed Write File, auch bei mir! |
| .dll, 0x00000001, adobe, alternate, autorun, benutzerregistrierung, bho, canon, defender, desktop, ebay, error, excel, excel.exe, explorer, fehler, flash player, format, google, home, iexplore.exe, install.exe, lexware, mbamservice.exe, nvlddmkm.sys, plug-in, realtek, registry, richtlinie, rundll, safer networking, scan, security, security scan, server, shell32.dll, software, taskhost.exe, usb, version=1.0, webcheck, windows |
Linear-Darstellung
