| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Gema trojaner - großes problemWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.11.2011, 00:10
| #1 |
| |  Gema trojaner - großes problem Hallo ich habe folgendes problem wenn ich den laptop anmache (Dell), nach dem anmelden kommt eine meldung mit GEMA ich habe die anweisungen von einem anderen thread ausprobiert und habe eine 'shell' text datei in welcher folgendes steht: WIN_7 X64 Service Pack 1 Running from H:\ HKLM\..\Winlogon; Shell = explorer.exe [ Microsoft Corporation ] . . . Modified HKCU shell extension. Current Shell File = C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe File C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe moved to H:\\infected or not found [System Process] System smss.exe csrss.exe wininit.exe csrss.exe services.exe lsass.exe lsm.exe winlogon.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe cmd.exe conhost.exe ctfmon.exe svchost.exe WmiPrvSE.exe srep.exe cmd.exe conhost.exe srep.exe HKLM\..\Run [StartCCC] = "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun HKLM\..\Run [Dell Webcam Central] = "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 HKLM\..\Run [VirtualCloneDrive] = "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s HKLM\..\Run [HTC Sync Loader] = "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup HKLM\..\Run [NBAgent] = "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart HKLM\..\Run [avgnt] = "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min HKLM\..\Run [Babylon Client] = C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe -AutoStart HKCU\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun HKCU\..\Run [msnmsgr] = "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background HKCU\..\Run [Skype] = "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized HKCU\..\Run [KPeerNexonEU] = C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe HKCU\..\Run [Facebook Update] = "C:\Users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver HKCU\..\Run [Akamai NetSession Interface] = C:\Users\Metalmaster\AppData\Local\Akamai\netsession_win.exe HKCU\..\Run [d56ij56itijcty] = C:\Users\Metalmaster\AppData\Roaming\e56ijd\ed6t57it5.exe HKCU\..\Run [zC1tx7LKsdR39Qk] = C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe HKU\.DEFAULT\..\Winlogon; Shell = HKU\S-1-5-19\..\Winlogon; Shell = HKU\S-1-5-20\..\Winlogon; Shell = HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Winlogon; Shell = explorer.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000_Classes\..\Winlogon; Shell = HKU\S-1-5-18\..\Winlogon; Shell = HKU\S-1-5-19\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-20\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [msnmsgr] = "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Skype] = "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [KPeerNexonEU] = C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Facebook Update] = "C:\Users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Akamai NetSession Interface] = C:\Users\Metalmaster\AppData\Local\Akamai\netsession_win.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [d56ij56itijcty] = C:\Users\Metalmaster\AppData\Roaming\e56ijd\ed6t57it5.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [zC1tx7LKsdR39Qk] = C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe x64 HKLMx64\..\Winlogon; Shell = explorer.exe [ 2871808- ] No action taken HKCUx6464\..\Winlogon; Shell = No action taken HKLMx64\..\Winlogon, Shell = explorer.exe HKCUx64\..\Winlogon, Shell = explorer.exe ==== FINISH 29.11-22.51 ==== WIN_7 X64 Service Pack 1 Running from H:\ HKLM\..\Winlogon; Shell = explorer.exe [ Microsoft Corporation ] . . . HKCU\..\Winlogon; Shell = explorer.exe . [System Process] System smss.exe csrss.exe wininit.exe csrss.exe services.exe lsass.exe lsm.exe winlogon.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe cmd.exe conhost.exe ctfmon.exe svchost.exe srep.exe WmiPrvSE.exe HKLM\..\Run [StartCCC] = "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun HKLM\..\Run [Dell Webcam Central] = "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 HKLM\..\Run [VirtualCloneDrive] = "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s HKLM\..\Run [HTC Sync Loader] = "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup HKLM\..\Run [NBAgent] = "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart HKLM\..\Run [avgnt] = "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min HKLM\..\Run [Babylon Client] = C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe -AutoStart HKCU\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun HKCU\..\Run [msnmsgr] = "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background HKCU\..\Run [Skype] = "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized HKCU\..\Run [KPeerNexonEU] = C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe HKCU\..\Run [Facebook Update] = "C:\Users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver HKCU\..\Run [Akamai NetSession Interface] = C:\Users\Metalmaster\AppData\Local\Akamai\netsession_win.exe HKCU\..\Run [d56ij56itijcty] = C:\Users\Metalmaster\AppData\Roaming\e56ijd\ed6t57it5.exe HKCU\..\Run [zC1tx7LKsdR39Qk] = C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe HKU\.DEFAULT\..\Winlogon; Shell = HKU\S-1-5-19\..\Winlogon; Shell = HKU\S-1-5-20\..\Winlogon; Shell = HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Winlogon; Shell = explorer.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000_Classes\..\Winlogon; Shell = HKU\S-1-5-18\..\Winlogon; Shell = HKU\S-1-5-19\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-20\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [msnmsgr] = "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Skype] = "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [KPeerNexonEU] = C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Facebook Update] = "C:\Users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [Akamai NetSession Interface] = C:\Users\Metalmaster\AppData\Local\Akamai\netsession_win.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [d56ij56itijcty] = C:\Users\Metalmaster\AppData\Roaming\e56ijd\ed6t57it5.exe HKU\S-1-5-21-4259231173-51643865-1593951088-1000\..\Run [zC1tx7LKsdR39Qk] = C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe x64 HKLMx64\..\Winlogon; Shell = explorer.exe [ 2871808- ] No action taken HKCUx6464\..\Winlogon; Shell = No action taken HKLMx64\..\Winlogon, Shell = explorer.exe HKCUx64\..\Winlogon, Shell = explorer.exe ==== FINISH 29.11-23.01 ==== ich hoffe mir kann da jetzt jemand weiterhelfen |
|
30.11.2011, 10:58
| #2 |
| /// Selecta Jahrusso   |  Gema trojaner - großes problem Mein Name ist Daniel und ich werde dir mit deinem Malware Relevanten Problemen helfen. Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Metalmaster\AppData\Roaming\e56ijd\ed6t57it5.exe
C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe
Starte deinen Rechner bitte erneut in den Abgesicherten Modus mit Eingabeaufforderung. Schließe deinen USB Stick erneut an den Infizierten Rechner. Bitte nutze den selben USB Steckplatz wie beim Scan
Berichte bitte, ob Du nun wieder auf den Infizierten Rechner zugreifen kannst.
__________________ |
|
02.12.2011, 23:31
| #3 |
| | Gema trojaner - großes problem danke, ich kann auf den pc zugreifen
__________________aber die desktop icons sind alle weg |
|
03.12.2011, 00:03
| #4 |
| /// Selecta Jahrusso | Gema trojaner - großes problem Die Interesieren uns später  Downloade dir bitte dds ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop. dds.com dds.scr dds.pif
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
03.12.2011, 17:24
| #5 |
| | Gema trojaner - großes problem dds.txt . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by Metalmaster at 16:58:10 on 2011-12-03 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3957.2628 [GMT 1:00] . AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\Dell\DellDock\DockLogin.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe C:\Windows\SysWOW64\svchost.exe -k Akamai C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe C:\Windows\system32\conhost.exe C:\Windows\system32\svchost.exe -k HPService C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Users\Metalmaster\AppData\Local\Akamai\netsession_win.exe C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Users\Metalmaster\AppData\Local\Akamai\netsession_win.exe c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Dell\DellDock\DellDock.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe c:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe C:\Program Files (x86)\Nero\Update\NASvc.exe C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe C:\Windows\system32\taskhost.exe \\?\C:\Windows\system32\wbem\WMIADAP.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\system32\WUDFHost.exe C:\Windows\system32\taskhost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.de/ mSearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 uURLSearchHooks: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files (x86)\BrotherSoft_Extreme\prxtbBrot.dll mURLSearchHooks: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files (x86)\BrotherSoft_Extreme\prxtbBrot.dll mWinlogon: Userinit=userinit.exe BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Babylon toolbar helper: {2eecd738-5844-4a99-b4b6-146bf802613b} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll BHO: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files (x86)\BrotherSoft_Extreme\prxtbBrot.dll BHO: CescrtHlpr Object: {64182481-4f71-486b-a045-b233bd0da8fc} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Babylon IE plugin: {9cfaccb6-2f3f-4177-94ea-0d2b72d384c1} - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: facemoods Toolbar: {db4e9724-f518-4dfd-9c7c-78b52103cab9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll TB: BrotherSoft Extreme Toolbar: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files (x86)\BrotherSoft_Extreme\prxtbBrot.dll TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized uRun: [KPeerNexonEU] C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe uRun: [Facebook Update] "C:\Users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver uRun: [Akamai NetSession Interface] C:\Users\Metalmaster\AppData\Local\Akamai\netsession_win.exe uRun: [d56ij56itijcty] C:\Users\Metalmaster\AppData\Roaming\e56ijd\ed6t57it5.exe uRun: [zC1tx7LKsdR39Qk] C:\Users\Metalmaster\AppData\Roaming\hw45esi4ss.exe mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s mRun: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup mRun: [NBAgent] "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun: [Babylon Client] C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe -AutoStart mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe StartupFolder: C:\Users\METALM~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: EnableLinkedConnections = 1 (0x1) IE: Bild an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Free YouTube Download - C:\Users\Metalmaster\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm IE: Free YouTube to MP3 Converter - C:\Users\Metalmaster\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm IE: Seite an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Translate this web page with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm IE: Translate with Babylon - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab TCP: Interfaces\{08F85809-F3DE-4436-B048-5D493F4B425B} : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{87CA6A76-C4A6-4602-B81B-9F9E42B18D1B} : DhcpNameServer = 192.168.2.1 TCP: Interfaces\{87CA6A76-C4A6-4602-B81B-9F9E42B18D1B}\46C696E6B6 : DhcpNameServer = 192.168.0.1 TCP: Interfaces\{9AE4E397-F4C7-4C8D-A16D-EC7A18EA0808} : DhcpNameServer = 192.168.42.129 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll {0347C33E-8762-4905-BF09-768834316C61} {18DF081C-E8AD-4283-A596-FA578C2EBDC3} {2EECD738-5844-4a99-B4B6-146BF802613B} {30F9B915-B755-4826-820B-08FBA6BD249D} {51a86bb3-6602-4c85-92a5-130ee4864f13} {64182481-4F71-486b-A045-B233BD0DA8FC} {9030D464-4C02-4ABF-8ECC-5164760863C6} {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} {9FDDE16B-836F-4806-AB1F-1455CBEFF289} {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} {DBC80044-A445-435b-BC74-9C25C1C588A9} {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} {32099AAC-C132-4136-9E9A-4E364A424E17} {51a86bb3-6602-4c85-92a5-130ee4864f13} {30F9B915-B755-4826-820B-08FBA6BD249D} {98889811-442D-49dd-99D7-DC866BE87DBC} TB-X64: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 mRun-x64: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s mRun-x64: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup mRun-x64: [NBAgent] "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun-x64: [Babylon Client] C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe -AutoStart mRunOnce-x64: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE-X64: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Metalmaster\AppData\Roaming\Mozilla\Firefox\Profiles\x1gwbtz2.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon) FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/home?AF=108554 FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=adbartrp&AF=108554&q= FF - prefs.js: network.proxy.type - 0 FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll FF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: extensions.BabylonToolbar_i.id - b8457168000000000000889ffabfd932 FF - user.js: extensions.BabylonToolbar_i.hardId - b8457168000000000000889ffabfd932 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15307 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1710:21:13 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babclient FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.newTab - false FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=108554 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - def FF - user.js: extensions.BabylonToolbar_i.instlRef - std . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys --> C:\Windows\system32\DRIVERS\avkmgr.sys [?] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-7-22 98208] R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-14 20992] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?] R2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-11-23 86224] R2 AntiVirService;Avira Echtzeit Scanner;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-11-23 110032] R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?] R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648] R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2011-7-22 690472] R2 PassThru Service;Internet Pass-Through Service;C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2010-9-16 80896] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atipmdag.sys --> C:\Windows\system32\DRIVERS\atipmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?] R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840] S3 HTCAND64;HTC Device Driver;C:\Windows\system32\Drivers\ANDROIDUSB.sys --> C:\Windows\system32\Drivers\ANDROIDUSB.sys [?] S3 htcnprot;HTC NDIS Protocol Driver;C:\Windows\system32\DRIVERS\htcnprot.sys --> C:\Windows\system32\DRIVERS\htcnprot.sys [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] . =============== Created Last 30 ================ . 2011-12-03 01:13:22 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B95DE6C5-0FA0-4899-9E57-393250C00182}\offreg.dll 2011-12-03 01:13:17 8822856 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B95DE6C5-0FA0-4899-9E57-393250C00182}\mpengine.dll 2011-12-02 22:36:44 -------- d-----w- C:\Users\Metalmaster\Neuer Ordner 2011-12-02 22:27:14 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{18247E0A-F715-456D-8143-C3991CBE9C3C} 2011-11-29 22:05:04 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{53BDC7C3-F1B4-4AA9-AC38-E6C5FC6CDABD} 2011-11-29 11:37:44 95744 ----a-w- C:\Users\Metalmaster\AppData\Roaming\dwlGina3.dll 2011-11-29 11:19:41 -------- d-----w- C:\Users\Metalmaster\AppData\Roaming\e56ijd 2011-11-29 09:22:05 -------- d-----w- C:\Users\Metalmaster\AppData\Local\Babylon 2011-11-29 09:21:28 143360 ----a-w- C:\Program Files (x86)\Mozilla Firefox\BabyFox.dll 2011-11-29 09:21:26 -------- d-----w- C:\Program Files\Babylon 2011-11-29 09:21:26 -------- d-----w- C:\Program Files (x86)\Babylon 2011-11-29 09:21:14 -------- d-----w- C:\Program Files (x86)\BabylonToolbar 2011-11-29 01:03:20 -------- d-----w- C:\Program Files (x86)\Infogrames Interactive 2011-11-26 23:31:06 -------- d-----w- C:\ProgramData\SimCity Societies 2011-11-26 20:34:48 -------- d-----w- C:\Program Files (x86)\Maxis 2011-11-26 20:33:06 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{6BB4BBB3-45F8-42EF-9B3D-4EF88BFC8F36} 2011-11-26 20:32:54 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{12E7B0AB-6DC5-428B-92E7-038FDF922403} 2011-11-26 20:22:38 -------- d-----w- C:\Program Files (x86)\directx 2011-11-26 20:20:44 -------- d-----w- C:\Program Files (x86)\Monte Cristo 2011-11-26 20:20:40 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll 2011-11-26 20:20:40 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll 2011-11-26 20:20:40 225280 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll 2011-11-26 20:20:40 176128 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll 2011-11-26 20:15:29 212992 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ILog.dll 2011-11-26 19:27:04 -------- d-----w- C:\Program Files\Microsoft IntelliPoint 2011-11-26 18:21:54 -------- d-----w- C:\Users\Metalmaster\Downloads 5000 2011-11-25 23:18:28 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{7A9CAE0C-1C59-4644-B342-C0436B65D75B} 2011-11-25 23:18:05 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{F51D3E1C-A2B5-4357-BC4D-81F82C2ACE00} 2011-11-25 23:17:58 -------- d-----w- C:\Users\Metalmaster\AppData\Roaming\Windows Live Writer 2011-11-25 23:17:58 -------- d-----w- C:\Users\Metalmaster\AppData\Local\Windows Live Writer 2011-11-23 04:13:00 -------- d-----w- C:\Users\Metalmaster\AppData\Roaming\Avira 2011-11-23 04:07:32 97312 ----a-w- C:\Windows\System32\drivers\avgntflt.sys 2011-11-23 04:07:32 27760 ----a-w- C:\Windows\System32\drivers\avkmgr.sys 2011-11-23 04:07:32 -------- d-----w- C:\ProgramData\Avira 2011-11-23 04:07:32 -------- d-----w- C:\Program Files (x86)\Avira 2011-11-22 18:20:32 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{433FF00E-8BD4-44C4-A443-E6B5454BFEA4} 2011-11-22 18:20:10 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{D09F33EA-6534-4944-9AB5-7B27EDF553D7} 2011-11-16 23:36:24 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{17B5D720-605E-43B6-B9E5-6A7C2D3A8426} 2011-11-11 02:32:38 -------- d-----w- C:\Users\Metalmaster\AppData\Local\Akamai 2011-11-09 00:19:43 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll 2011-11-09 00:19:43 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll 2011-11-09 00:19:42 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys 2011-11-09 00:19:41 3144704 ----a-w- C:\Windows\System32\win32k.sys 2011-11-05 20:23:23 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{C33ABAB0-92B9-4776-B64D-5D4C4A7DE641} 2011-11-05 20:22:10 -------- d-----w- C:\Users\Metalmaster\AppData\Local\{AB2D8219-9CDD-43E5-9BD7-EACF666CCB26} . ==================== Find3M ==================== . 2011-10-19 23:27:40 235 ----a-w- C:\Windows\SysWow64\nxEuUninstall.bat 2011-10-19 23:27:39 446464 ----a-w- C:\Windows\NEXON_EU_DownloaderUpdater.exe 2011-10-19 23:27:32 524288 ----a-w- C:\Users\Metalmaster\MSE_Downloader.exe . ============= FINISH: 16:59:16,30 =============== attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 01.05.2011 21:58:26 System Uptime: 03.12.2011 15:27:52 (1 hours ago) . Motherboard: Dell Inc. | | 09GVFD Processor: Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz | U2E1 | 1847/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 451 GiB total, 129,339 GiB free. D: is CDROM (UDF) E: is CDROM () F: is CDROM () G: is CDROM () H: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP163: 05.11.2011 22:29:07 - Windows Update RP164: 09.11.2011 01:16:40 - Windows Update RP165: 11.11.2011 02:31:33 - Windows Update RP166: 11.11.2011 03:00:10 - Windows Update RP167: 17.11.2011 00:49:53 - Windows Update RP168: 22.11.2011 18:58:49 - Windows Update RP169: 25.11.2011 22:23:13 - Windows Update RP170: 26.11.2011 21:53:08 - Microsoft Visual C++ 2005 Redistributable wird installiert RP171: 26.11.2011 21:54:59 - Installed ProductName RP172: 27.11.2011 00:40:49 - Removed SimCity™ Societies RP173: 27.11.2011 00:47:14 - Installed ProductName RP174: 29.11.2011 02:02:53 - Installed RollerCoaster Tycoon 2 RP176: 29.11.2011 02:13:17 - Windows Defender Checkpoint RP177: 29.11.2011 22:15:07 - Windows Update RP178: 03.12.2011 02:11:43 - Windows Update . ==== Installed Programs ====================== . 4500_G510gm_Help 4500G510gm 4500G510gm_Software_Min Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 9.2 - Deutsch Advanced Audio FX Engine Akamai NetSession Interface Akamai NetSession Interface Service ATI Catalyst Control Center µTorrent Avira Free Antivirus Babylon Babylon toolbar on IE Borderlands GOTY Edition BrotherSoft Extreme Toolbar BufferChm Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module Conduit Engine ConvertXtoDVD 4.1.19.364 D3DX10 DAEMON Tools Lite DAEMON Tools Toolbar Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell Dock Dell Webcam Central Destinations DeviceDiscovery Dino Island DocMgr DocProc EasyBits GO eBay Europe MapleStory Facebook Video Calling 1.0.0.8953 Facemoods Toolbar Fax Free Studio version 5.1.4 GPBaseService2 Guitar Pro 5.0 Hama Black Force Pad High-Definition Video Playback HP Update HPProductAssistant HPSSupply HTC BMP USB Driver HTC Driver Installer HTC Sync ImgBurn Intel(R) Management Engine Components Java Auto Updater Java(TM) 6 Update 22 JDownloader 0.9 Junk Mail filter update Live! Cam Avatar Creator MarketResearch Mesh Runtime Messenger Companion Microsoft Office 2010 Microsoft Office Word Viewer 2003 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Minecraft Beta Cracked Mozilla Firefox 6.0.2 (x86 de) MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP3 Parser MSXML 4.0 SP3 Parser (KB973685) Nero 10 Menu TemplatePack Basic Nero 10 Movie ThemePack Basic Nero BackItUp 10 Nero BackItUp 10 Help (CHM) Nero Burning ROM 10 Nero BurningROM 10 Help (CHM) Nero BurnLite 10 Nero BurnRights 10 Nero BurnRights 10 Help (CHM) Nero Control Center 10 Nero ControlCenter 10 Help (CHM) Nero Core Components 10 Nero CoverDesigner 10 Help (CHM) Nero DiscSpeed 10 Nero DiscSpeed 10 Help (CHM) Nero Dolby Files 10 Nero Express 10 Nero Express 10 Help (CHM) Nero InfoTool 10 Nero InfoTool 10 Help (CHM) Nero Kwik Media Nero Multimedia Suite 10 Nero Recode 10 Nero Recode 10 Help (CHM) Nero RescueAgent 10 Nero RescueAgent 10 Help (CHM) Nero SoundTrax 10 Nero SoundTrax 10 Help (CHM) Nero StartSmart 10 Nero StartSmart 10 Help (CHM) Nero Update Nero Vision 10 Nero Vision 10 Help (CHM) Nero WaveEditor 10 Nero WaveEditor 10 Help (CHM) NeroKwikMedia Help (CHM) NVIDIA PhysX OpenOffice.org 3.3 Project64 1.6 Realtek High Definition Audio Driver RollerCoaster Tycoon 2 Roxio Burn Scan Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870) SimCity 4 Deluxe SimCity™ Societies Skins Skype Click to Call Skype™ 5.5 SmartWebPrinting SolutionCenter Status TeamViewer 6 Toolbox TrayApp Tube Downloader Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) VirtualCloneDrive VLC media player 1.1.10 WebReg Winamp Winamp Erkennungs-Plug-in Windows Live Communications Platform Windows Live Essentials Windows Live Fotogalerie Windows Live Installer Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX control for remote connections Windows Live Messenger Windows Live Messenger Companion Core Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinRAR 4.00 (32-Bit) . ==== End Of File =========================== |
|
03.12.2011, 18:22
| #6 | |
| /// Selecta Jahrusso | Gema trojaner - großes problem Good work Deinstalliere bitte Conduit Engine Babylon toolbar on IE (<< wenn nicht wirklich benötigt ) BrotherSoft Extreme Toolbar (<< wenn nicht wirklich benötigt ) Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
Wenn wir die Bereinigung beendet haben, starte bitte defogger erneut und klicke den Re-enable Button. Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
Bitte poste in deiner nächsten Antwort Combofix.txt
__________________ --> Gema trojaner - großes problem |
|
03.12.2011, 19:24
| #7 |
| | Gema trojaner - großes problem defogger erforderte keinen neustart seltsamerweise defogger_disable by jpshortstuff (23.02.10.1) Log created at 18:58 on 03/12/2011 (Metalmaster) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Combofix Combofix Logfile: Code:
ATTFilter ComboFix 11-12-03.01 - Metalmaster 03.12.2011 19:08:28.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3957.2528 [GMT 1:00]
ausgeführt von:: c:\users\Metalmaster\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\faCEmoodstlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\uninstall.exe
c:\users\Metalmaster\AppData\Roaming\dwlGina3.dll
c:\users\Metalmaster\AppData\Roaming\vso_ts_preview.xml
c:\users\Metalmaster\Documents\Downloads\CT2776682_BrotherSoft_Extreme.exe
c:\users\Metalmaster\MSE_Downloader.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-11-03 bis 2011-12-03 ))))))))))))))))))))))))))))))
.
.
2011-12-03 18:12 . 2011-12-03 18:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-03 16:31 . 2011-12-03 16:31 -------- d-----w- c:\users\Metalmaster\AppData\Local\Apps
2011-12-03 01:13 . 2011-12-03 01:13 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B95DE6C5-0FA0-4899-9E57-393250C00182}\offreg.dll
2011-12-03 01:13 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B95DE6C5-0FA0-4899-9E57-393250C00182}\mpengine.dll
2011-12-02 22:36 . 2011-12-02 22:37 -------- d-----w- c:\users\Metalmaster\Neuer Ordner
2011-11-29 11:19 . 2011-12-02 22:21 -------- d-----w- c:\users\Metalmaster\AppData\Roaming\e56ijd
2011-11-29 09:22 . 2011-11-29 09:22 -------- d-----w- c:\users\Metalmaster\AppData\Local\Babylon
2011-11-29 09:21 . 2011-08-22 06:12 143360 ----a-w- c:\program files (x86)\Mozilla Firefox\BabyFox.dll
2011-11-29 09:21 . 2011-11-29 09:21 -------- d-----w- c:\program files\Babylon
2011-11-29 09:21 . 2011-11-29 09:21 -------- d-----w- c:\program files (x86)\Babylon
2011-11-29 09:21 . 2011-11-29 09:21 238 ----a-w- C:\user.js
2011-11-29 01:03 . 2011-11-29 01:03 -------- d-----w- c:\program files (x86)\Infogrames Interactive
2011-11-26 23:56 . 2011-11-26 23:56 -------- d--h--r- c:\users\Metalmaster\AppData\Roaming\SecuROM
2011-11-26 23:31 . 2011-11-26 23:31 -------- d-----w- c:\programdata\SimCity Societies
2011-11-26 20:34 . 2011-11-26 20:34 -------- d-----w- c:\program files (x86)\Maxis
2011-11-26 20:22 . 2011-11-26 20:22 -------- d-----w- c:\program files (x86)\directx
2011-11-26 20:20 . 2011-11-26 20:20 -------- d-----w- c:\program files (x86)\Monte Cristo
2011-11-26 20:20 . 2001-09-05 03:18 77824 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2011-11-26 20:20 . 2001-09-05 03:18 225280 ----a-w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-11-26 20:20 . 2001-09-05 03:14 176128 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-11-26 20:20 . 2001-09-05 03:13 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-11-26 20:15 . 2000-01-04 05:39 212992 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2011-11-26 19:27 . 2011-11-26 19:27 -------- d-----w- c:\program files\Microsoft IntelliPoint
2011-11-26 18:21 . 2011-11-26 20:00 -------- d-----w- c:\users\Metalmaster\Downloads 5000
2011-11-25 23:17 . 2011-11-25 23:21 -------- d-----w- c:\users\Metalmaster\AppData\Roaming\Windows Live Writer
2011-11-25 23:17 . 2011-11-25 23:18 -------- d-----w- c:\users\Metalmaster\AppData\Local\Windows Live Writer
2011-11-23 04:13 . 2011-11-23 04:13 -------- d-----w- c:\users\Metalmaster\AppData\Roaming\Avira
2011-11-23 04:07 . 2011-11-23 04:07 -------- d-----w- c:\programdata\Avira
2011-11-23 04:07 . 2011-11-23 04:07 -------- d-----w- c:\program files (x86)\Avira
2011-11-23 04:07 . 2011-10-19 15:56 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-11-23 04:07 . 2011-10-19 15:56 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2011-11-23 04:07 . 2011-10-19 15:56 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-11-11 02:32 . 2011-11-20 16:41 -------- d-----w- c:\users\Metalmaster\AppData\Local\Akamai
2011-11-09 00:19 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll
2011-11-09 00:19 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-09 00:19 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 00:19 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-19 23:27 . 2011-10-19 23:27 235 ----a-w- c:\windows\SysWow64\nxEuUninstall.bat
2011-10-19 23:27 . 2011-10-19 23:27 446464 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"KPeerNexonEU"="c:\nexon\NEXON_EU_Downloader\nxEULauncher.exe" [2011-10-19 438272]
"Facebook Update"="c:\users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-10-25 137536]
"Akamai NetSession Interface"="c:\users\Metalmaster\AppData\Local\Akamai\netsession_win.exe" [2011-11-17 3303000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-22 98304]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2010-10-28 294912]
"NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2011-04-08 1406248]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-19 258512]
"Babylon Client"="c:\program files (x86)\Babylon\Babylon-Pro\Babylon.exe" [2011-08-25 3346544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2010-08-20 566232]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-08-12 163040]
.
c:\users\Metalmaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-18 1080096]
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-19 86224]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-07-22 690472]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2010-09-16 80896]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Akamai REG_MULTI_SZ Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2011-11-27 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4259231173-51643865-1593951088-1000Core.job
- c:\users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-25 22:48]
.
2011-12-03 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4259231173-51643865-1593951088-1000UA.job
- c:\users\Metalmaster\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-25 22:48]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-03 10038304]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube Download - c:\users\Metalmaster\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Metalmaster\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
FF - ProfilePath - c:\users\Metalmaster\AppData\Roaming\Mozilla\Firefox\Profiles\x1gwbtz2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/home?AF=108554
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=adbartrp&AF=108554&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.BabylonToolbar_i.id - b8457168000000000000889ffabfd932
FF - user.js: extensions.BabylonToolbar_i.hardId - b8457168000000000000889ffabfd932
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15307
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1710:21
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babclient
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=108554
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - def
FF - user.js: extensions.BabylonToolbar_i.instlRef - std
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{51a86bb3-6602-4c85-92a5-130ee4864f13} - (no file)
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-d56ij56itijcty - c:\users\Metalmaster\AppData\Roaming\e56ijd\ed6t57it5.exe
Wow6432Node-HKCU-Run-zC1tx7LKsdR39Qk - c:\users\Metalmaster\AppData\Roaming\hw45esi4ss.exe
Toolbar-Locked - (no file)
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_d768ebc.dll"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4259231173-51643865-1593951088-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-4259231173-51643865-1593951088-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-12-03 19:14:14
ComboFix-quarantined-files.txt 2011-12-03 18:14
.
Vor Suchlauf: 16 Verzeichnis(se), 138.775.699.456 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 138.514.661.376 Bytes frei
.
- - End Of File - - 34DDBC4FCFDF6BB1E36581BFC9B76C75
|
|
03.12.2011, 20:10
| #8 |
| /// Selecta Jahrusso | Gema trojaner - großes problem Hy, Die Log sieht gut aus, wie siehts auf deinem System aus ?
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
03.12.2011, 20:17
| #9 |
| | Gema trojaner - großes problem die desktop dateien sind weg immernoch, sonst denk ich alles ok |
|
03.12.2011, 20:29
| #10 |
| /// Selecta Jahrusso | Gema trojaner - großes problem Aber die Taskleiste ist vorhanden ? Downloade bitte Grinler's unhide.exe auf deinem Desktop Starte das Tool mit Doppelklick. Wenn es seine Arbeit getan hat, wir eine Nachricht mit Done aufpoppen Berichte ob die Dateien wieder da sind
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
04.12.2011, 00:44
| #11 |
| | Gema trojaner - großes problem ja, die taskleiste ist da =) aber die dateien sind leider immernoch nicht da unhide.exe hilft leider nicht |
|
04.12.2011, 05:07
| #12 |
| /// Selecta Jahrusso | Gema trojaner - großes problem Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter @echo off
>look.txt (
dir /a /b "%userprofile%\desktop"
echo.
type "C:\Qoobox\ComboFix-quarantined-files.txt"
)
notepad look.txt
del %0
Es wird sich ein Textdokument öffnen, poste den Inhalt bitte hier
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
07.12.2011, 18:03
| #13 |
| /// Selecta Jahrusso | Gema trojaner - großes problem Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
| Themen zu Gema trojaner - großes problem |
| akamai, anmelden, antivir, appdata, avg, avgnt, avira, babylon, datei, desktop, downloader, explorer.exe, file, folge, gema trojaner, gema..., infected, laptop, live, messenger, microsoft, moved, problem, system, trojaner, update, webcam, weg..., windows, windows live, winlogon |
Linear-Darstellung
