| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner sbcvvhost_win86 blockiert Windows SystemWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.12.2011, 17:01
| #1 |
| |  Trojaner sbcvvhost_win86 blockiert Windows System Guten Tag, ich habe ähnliches Problem wie Jonne in diesem Thread: http://www.trojaner-board.de/106759-...blockiert.html Ich habe Windows Vista und es kommt beim normalen Start sowie beim Start im abgesicherten Modus nur ein weißer Bildschirm mit einem Fenster in dem steht: "Es konnte noch keine Verbindung zum Internet hergestellt werden, bitte warten!" Vom normalen Windows Interface ist keine Spur. Ich konnte über Str+ALT+Entf ins Windows Menü, über das sich der Task Manager aber nicht öffnen ließ. Beim Versuch den PC herunterzufahren kam die Meldung, dass sbcvvhost_win86.exe dies verhindern würde. Man konnte dennoch das Herunterfahren erzwingen. Ich habe einen OTL Scan nach den Vorgaben die in Jonne'S Thread (siehe oben) (Minimal Output/ Extra Registry > use SafeList) angegeben wurden gemacht. OTL.txt und Extras.txt im folgenden: OTL.txt Code:
ATTFilter OTL logfile created on: 23.12.2011 16:31:38 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\ Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,75 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 75,57% Memory free 3,74 Gb Paging File | 3,46 Gb Available in Paging File | 92,57% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 286,09 Gb Total Space | 195,14 Gb Free Space | 68,21% Space Free | Partition Type: NTFS Drive E: | 14,94 Gb Total Space | 14,85 Gb Free Space | 99,41% Space Free | Partition Type: NTFS Computer Name: MANFRED-PC | User Name: Manfred | Logged in as Administrator. Boot Mode: SafeMode | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\OTL.exe (OldTimer Tools) PRC - C:\Windows\System32\cmd.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (vsmon) -- C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD) SRV - (IswSvc) -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies) SRV - (Symantec Core LC) -- C:\Programme\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe () SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation) SRV - (Automatic LiveUpdate Scheduler) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation) SRV - (LiveUpdate Notice) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (CLTNetCnService) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (ezSharedSvc) -- C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (comHost) -- C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (Symantec Corporation) SRV - (IJPLMSVC) -- C:\Programme\Canon\IJPLM\ijplmsvc.exe () ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (ISWKL) -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies) DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD) DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation) DRV - (SymIM) -- C:\Windows\System32\drivers\SymIMV.sys (Symantec Corporation) DRV - (SYMTDI) -- C:\Windows\System32\Drivers\SYMTDI.SYS (Symantec Corporation) DRV - (SYMREDRV) -- C:\Windows\System32\Drivers\SYMREDRV.SYS (Symantec Corporation) DRV - (SRTSPL) -- C:\Windows\System32\drivers\srtspl.sys (Symantec Corporation) DRV - (SRTSP) -- C:\Windows\System32\drivers\srtsp.sys (Symantec Corporation) DRV - (SRTSPX) -- C:\Windows\System32\drivers\srtspx.sys (Symantec Corporation) DRV - (NAVEX15) -- C:\ProgramData\Symantec\Definitions\VirusDefs\20080122.037\NAVEX15.SYS (Symantec Corporation) DRV - (NAVENG) -- C:\ProgramData\Symantec\Definitions\VirusDefs\20080122.037\NAVENG.SYS (Symantec Corporation) DRV - (SPBBCDrv) -- C:\Programme\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (IDSvix86) -- C:\ProgramData\Symantec\Definitions\SymcData\ipsdefs\20071204.002\IDSvix86.sys (Symantec Corporation) DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation) DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation) DRV - (nvsmu) -- C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (CO_Mon) -- C:\Windows\System32\drivers\CO_Mon.sys (Symantec Corporation) DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH) DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin) DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation) DRV - (BsUDF) -- C:\Windows\System32\drivers\bsudf.sys (ahead software) DRV - (BsStor) -- C:\Windows\System32\DRIVERS\bsstor.sys (B.H.A Co.,Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp32&d=0311&m=imedia_d3000_ge IE - HKLM\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp32&d=0311&m=imedia_d3000_ge IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=1&o=vp32&d=0311&m=imedia_d3000_ge IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011.03.28 18:46:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.09 23:21:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.28 17:23:03 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Manfred\AppData\Roaming\mozilla\Extensions [2011.03.28 18:34:57 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Manfred\AppData\Roaming\mozilla\Firefox\Profiles\zwwvwpsj.default\extensions [2011.03.28 17:22:56 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.04.02 08:49:37 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2011.11.09 23:21:38 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010.01.01 09:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.01.01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2010.01.01 09:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2010.01.01 09:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010.01.01 09:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2010.01.01 09:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Reg Error: Value error.) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.) O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll̀ File not found O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm-Sicherheit Toolbar) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll̀ File not found O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLANMini.exe (AVM Berlin) O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe (Carbonite, Inc.) O4 - HKLM..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe (Copyright (C) ahead software gmbh and its licensors) O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies) O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [WBhXTAWuFpmNyON] C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe (vKJZdfXv) O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) O4 - HKCU..\Run: [{FB559667-5940-11E0-A1D4-806E6F6E6963}] C:\Users\Manfred\AppData\Roaming\Microsoft\dllhsts.exe (Mozilla Foundation) O4 - HKCU..\Run: [SmpcSys] C:\Programme\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV) O4 - HKCU..\Run: [WBhXTAWuFpmNyON] C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe (vKJZdfXv) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{68955441-A1BC-4314-9BE2-8063ACCADD2B}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe) -C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe (vKJZdfXv) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\ezShellStart.exe) -C:\Windows\System32\ezShellStart.exe (EasyBits Software AS) O20 - HKCU Winlogon: Shell - (C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe) -C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe (vKJZdfXv) O24 - Desktop WallPaper: C:\Users\Manfred\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Manfred\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\System32\ezUPBHook.dll (EasyBits Software Corp.) O31 - SafeBoot: UseAlternatShell - 1 O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{47929e0e-94f5-11e0-a147-001f3f097b24}\Shell - "" = AutoRun O33 - MountPoints2\{47929e0e-94f5-11e0-a147-001f3f097b24}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O33 - MountPoints2\{7b68f161-5941-11e0-8b50-00219734bae4}\Shell - "" = AutoRun O33 - MountPoints2\{7b68f161-5941-11e0-8b50-00219734bae4}\Shell\AutoRun\command - "" = E:\pushinst.exe O33 - MountPoints2\{c1781fc9-5952-11e0-8734-001f3f097b24}\Shell - "" = AutoRun O33 - MountPoints2\{c1781fc9-5952-11e0-8734-001f3f097b24}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.12.23 15:59:18 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\OTL.exe [2011.12.22 20:39:43 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Users\Manfred\AppData\Roaming\dwlGina3.dll [2011.12.22 20:36:22 | 000,327,680 | ---- | C] (vKJZdfXv) -- C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe [2011.12.07 17:51:52 | 000,000,000 | ---D | C] -- C:\Users\Manfred\AppData\Roaming\Nero [2011.11.27 18:56:45 | 000,000,000 | ---D | C] -- C:\Users\Manfred\AppData\Roaming\elsterformular [2011.11.27 18:47:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular [2011.11.27 18:47:01 | 000,000,000 | ---D | C] -- C:\ProgramData\elsterformular [2011.11.27 18:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\ElsterFormular [2011.11.27 18:38:30 | 000,000,000 | ---D | C] -- C:\Users\Manfred\Documents\Einkommensteuererklärung 2010 [2011.08.19 22:04:40 | 000,189,952 | ---- | C] (Heaventools Software) -- C:\Users\Manfred\AppData\Roaming\jashla.exe ========== Files - Modified Within 30 Days ========== [2011.12.23 15:57:42 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.12.23 15:57:42 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.12.23 15:57:42 | 000,125,870 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.12.23 15:57:42 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.12.23 15:53:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.23 15:52:15 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.23 15:52:15 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.23 15:26:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\OTL.exe [2011.12.23 14:53:06 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.22 21:00:00 | 000,000,344 | -H-- | M] () -- C:\Windows\tasks\Erweiterte Garantie-Manfred.job [2011.12.22 20:39:43 | 000,095,744 | ---- | M] (Kassl GmbH) -- C:\Users\Manfred\AppData\Roaming\dwlGina3.dll [2011.12.22 20:36:20 | 000,327,680 | ---- | M] (vKJZdfXv) -- C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe [2011.12.22 19:02:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.18 23:47:06 | 000,002,627 | -H-- | M] () -- C:\Users\Manfred\Desktop\Microsoft Office Word 2007.lnk [2011.12.12 21:21:14 | 000,001,025 | ---- | M] () -- C:\Users\Manfred\Desktop\ElsterFormular.lnk [2011.11.30 18:53:18 | 000,014,505 | ---- | M] () -- C:\Users\Manfred\ESt-Erklärung 2010-1.elfo [2011.11.27 22:26:16 | 000,011,831 | ---- | M] () -- C:\Users\Manfred\ESt-Erklärung 2010.elfo [2011.11.27 18:47:02 | 000,001,025 | ---- | M] () -- C:\Users\Public\Desktop\ElsterFormular.lnk ========== Files Created - No Company Name ========== [2011.12.12 21:21:14 | 000,001,025 | ---- | C] () -- C:\Users\Manfred\Desktop\ElsterFormular.lnk [2011.11.27 23:19:25 | 000,014,505 | ---- | C] () -- C:\Users\Manfred\ESt-Erklärung 2010-1.elfo [2011.11.27 22:26:10 | 000,011,831 | ---- | C] () -- C:\Users\Manfred\ESt-Erklärung 2010.elfo [2011.11.27 18:47:02 | 000,001,025 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular.lnk [2011.04.03 12:39:17 | 000,000,412 | ---- | C] () -- C:\Windows\MAXLINK.INI [2011.03.28 15:41:41 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin [2011.03.28 14:52:48 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat [2011.03.28 14:52:39 | 000,008,172 | ---- | C] () -- C:\Windows\System32\ezdigsgn.dat [2008.09.18 09:08:25 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2008.09.18 09:08:25 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.09.18 09:03:13 | 000,627,756 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.09.18 09:03:13 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.09.18 09:03:13 | 000,125,870 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.09.18 09:03:13 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 13:47:37 | 000,378,744 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 11:33:01 | 000,595,386 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,103,460 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat < End of report > Extras.txt Code:
ATTFilter OTL Extras logfile created on: 23.12.2011 16:31:38 - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,75 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 75,57% Memory free
3,74 Gb Paging File | 3,46 Gb Available in Paging File | 92,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286,09 Gb Total Space | 195,14 Gb Free Space | 68,21% Space Free | Partition Type: NTFS
Drive E: | 14,94 Gb Total Space | 14,85 Gb Free Space | 99,41% Space Free | Partition Type: NTFS
Computer Name: MANFRED-PC | User Name: Manfred | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06A654B6-9717-4BF4-A7B9-A034275D63D6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3A198747-F2E2-475C-9457-8089B780BE36}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{6F39E38F-E27C-4C01-AEFC-C2EC069B5C7B}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{75F47EED-DFD7-486D-BD8C-61B576985D86}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{B1AE977E-0670-423B-A48F-7A4BB485A637}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{DE260692-1DB0-4CB7-8A8F-BF165F777A92}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{F57F385C-2E18-4BA4-B795-B53EF5DB20D8}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}" = Component Framework
"{3559CDE0-11FC-4D7B-A65C-D646035B1031}" = Nero 8 Essentials
"{3672B097-EA69-4BFE-B92F-29AE6D9D2B34}" = Norton Internet Security
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{55A6283C-638A-4EE0-B491-51118554BDA2}" = Norton Confidential Core
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{62120008-8E1E-4807-860D-A8B48F8552DB}" = Norton Protection Center
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" = ccCommon
"{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D359B12F-9B1A-46FD-B70C-F507B5B11590}" = HDRegDE
"{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}" = Symantec Real Time Storage Protection Component
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton AntiVirus Help
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"AdobeReader" = Adobe Reader 8
"AUDIO_REALTEK" = Realtek HD Audio V6.0.1.5618
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon MP970 series Benutzerregistrierung" = Canon MP970 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = PIXMA Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Carbonite" = Carbonite
"Carbonite Setup Lite" = Sichern Sie Ihre Daten
"Easybits Magic Desktop" = EasyBits Magic Desktop
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"ElsterFormular 12.4.0.7094p" = ElsterFormular
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Google Desktop" = Google Desktop
"GoogleDesktop" = GoogleDesktop
"GoogleToolbar" = Google Toolbar
"ImageWriter" = Packard Bell ImageWriter
"InCD!UninstallKey" = InCD (Ahead Software)
"Infocentre" = Infocentre Rev. 2.0
"LCDTest" = Packard Bell LCD Test
"magicdesktop" = Easybits Magic Desktop
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"METABOLI" = Metaboli
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"Nero - Burning Rom!UninstallKey" = Nero 6 Demo
"Nero8" = Nero 8 Essentials
"NeroVision!UninstallKey" = NeroVision Express 2
"NIS2008_DE" = Norton Internet Security
"NVIDIA Drivers" = NVIDIA Drivers
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"SETUPMYPC_DE" = SetUp My PC
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SymSetup.{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security (Symantec Corporation)
"Updator" = Packard Bell Updator
"VIDEO_NVIDIA_GOB" = Video NVIDIA V163.96
"ZoneAlarm" = ZoneAlarm
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 20.12.2011 08:20:13 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 20.12.2011 15:39:52 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 20.12.2011 15:45:05 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 21.12.2011 08:11:12 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 21.12.2011 13:27:30 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 22.12.2011 01:24:29 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 22.12.2011 11:55:03 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 22.12.2011 15:41:08 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 22.12.2011 15:44:58 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
Error - 22.12.2011 15:49:25 | Computer Name = Manfred-PC | Source = WinMgmt | ID = 10
Description =
[ Media Center Events ]
Error - 27.11.2011 06:03:45 | Computer Name = Manfred-PC | Source = MCUpdate | ID = 0
Description = Fehler beim Herstellen der Internetverbindung. (2992.1128)
Error - 27.11.2011 06:03:45 | Computer Name = Manfred-PC | Source = MCUpdate | ID = 0
Description = Serververbindung konnte nicht hergestellt werden.. (2992.1129)
[ System Events ]
Error - 04.07.2011 01:04:29 | Computer Name = Manfred-PC | Source = HTTP | ID = 15016
Description =
Error - 04.07.2011 16:04:07 | Computer Name = Manfred-PC | Source = HTTP | ID = 15016
Description =
Error - 04.07.2011 17:17:02 | Computer Name = Manfred-PC | Source = BROWSER | ID = 8032
Description =
Error - 05.07.2011 00:50:22 | Computer Name = Manfred-PC | Source = HTTP | ID = 15016
Description =
Error - 05.07.2011 00:50:24 | Computer Name = Manfred-PC | Source = Microsoft-Windows-ResourcePublication | ID = 1002
Description =
Error - 05.07.2011 14:18:36 | Computer Name = Manfred-PC | Source = HTTP | ID = 15016
Description =
Error - 05.07.2011 14:38:22 | Computer Name = Manfred-PC | Source = BROWSER | ID = 8032
Description =
Error - 05.07.2011 17:03:45 | Computer Name = Manfred-PC | Source = BROWSER | ID = 8032
Description =
Error - 06.07.2011 02:06:49 | Computer Name = Manfred-PC | Source = HTTP | ID = 15016
Description =
Error - 06.07.2011 11:53:33 | Computer Name = Manfred-PC | Source = HTTP | ID = 15016
Description =
< End of report >
Ich bitte um Hilfe und danke schonmal für evtl. Antworten. gruß Loop |
|
23.12.2011, 17:08
| #2 |
| /// Malware-holic   | Trojaner sbcvvhost_win86 blockiert Windows System hi
__________________achtung! dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKCU..\Run: [{FB559667-5940-11E0-A1D4-806E6F6E6963}] C:\Users\Manfred\AppData\Roaming\Microsoft\dllhsts.exe (Mozilla Foundation)
O4 - HKCU..\Run: [WBhXTAWuFpmNyON] C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe (vKJZdfXv)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe) -C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe (vKJZdfXv)
O20 - HKCU Winlogon: Shell - (C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe) -C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe (vKJZdfXv)
[2011.12.22 20:39:43 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Users\Manfred\AppData\Roaming\dwlGina3.dll
:Files
C:\Users\Manfred\AppData\Roaming\Microsoft\dllhsts.exe
C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden öffne computer, öffne C: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. folge dem link, und lade das archiv im upload channel hoch http://www.trojaner-board.de/54791-a...ner-board.html
__________________ |
|
23.12.2011, 17:57
| #3 |
| | Trojaner sbcvvhost_win86 blockiert Windows System Hi markus,
__________________danke für deine schnelle Antwort. Habe den Fix mit deinem Code durchgeführt. OTL ist allerdings mit den 2 restlichen Zeilen: Code:
ATTFilter [emptytemp]
[Reboot]
über 15 Minuten tat sich nichts mehr. Ich konnte den Mauszeiger noch bewegen, aber nichts mehr drücken. Scheinbar war der PC abgestürzt. Ich habe im normalen Modus neugestartet. Besagte Meldung kam nicht mehr, sondern der normale Windows Desktop. Ich denke mal die .txt die jetzt das Ergebnis schildern soll ist durch den Absturz nicht erstellt worden!? Jedenfalls habe ich im Ordner der OTL.exe nur die 2 vom Scan erstellten otl.txt und extras.txt gefunden und eine ältere (vor 2 Jahren erstellt). Im _otl Ordner wurde allerdings der Moved Files Ordner erstellt. Ich denke aber mal durch den Absturz auch nicht für den Upload Channel zu gebrauchen oder? Kann/soll ich den Fix mit deinem Code jetzt nochmal durchführen oder kann da jetzt was schiefgehen weil der ja eig schonmal durchgelaufen ist? gruß Loop |
|
23.12.2011, 18:00
| #4 |
| /// Malware-holic | Trojaner sbcvvhost_win86 blockiert Windows System ja, versuche es, wenn es wieder nicht klappt, lad den moved files ordner hoch und dann gucke ich mir das mal an
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
23.12.2011, 18:37
| #5 |
| | Trojaner sbcvvhost_win86 blockiert Windows System Ok also beim 2. Mal habe ich den Fix jetzt noch einige Minuten länger durchlaufen lassen und dann war er erfolgreich abgeschlossen! Habe also beim 1. Mal nicht lange genug gewartet, da ich den Eindruck hatte es tut sich nichts mehr. Das Textdokument erschien jetzt auch beim Neustart: Code:
ATTFilter All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{FB559667-5940-11E0-A1D4-806E6F6E6963} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB559667-5940-11E0-A1D4-806E6F6E6963}\ not found.
File C:\Users\Manfred\AppData\Roaming\Microsoft\dllhsts.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\WBhXTAWuFpmNyON not found.
File C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe deleted successfully.
File \Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe) -C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe deleted successfully.
File \Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe) -C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe not found.
File C:\Users\Manfred\AppData\Roaming\dwlGina3.dll not found.
========== FILES ==========
File\Folder C:\Users\Manfred\AppData\Roaming\Microsoft\dllhsts.exe not found.
File\Folder C:\Users\Manfred\AppData\Roaming\sbcvvhost_win86.exe not found.
========== COMMANDS ==========
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Manfred
->Flash cache emptied: 611 bytes
User: Public
Total Flash Files Cleaned = 0,00 mb
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Manfred
->Temp folder emptied: 173362926 bytes
->Temporary Internet Files folder emptied: 51779226 bytes
->FireFox cache emptied: 1075455205 bytes
->Flash cache emptied: 0 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 46216209 bytes
RecycleBin emptied: 14717413755 bytes
Total Files Cleaned = 15.320,00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 12232011_180637
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Dort sind jetzt aber aufgrund von 2 durchläufen auch 2 Ordner drin! Scheinbar läuft alles jetzt wieder normal. Danke für deine Hilfe. Ist zur absoluten Bereinigung jetzt noch irgendetwas zu unternehmen? gruß Loop |
|
23.12.2011, 18:39
| #6 |
| /// Malware-holic | Trojaner sbcvvhost_win86 blockiert Windows System na 2 ordner, das wird mich hoffendlich nicht überfordern :-) danke für den upload :-) combofix: Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ --> Trojaner sbcvvhost_win86 blockiert Windows System |
|
23.12.2011, 19:16
| #7 |
| | Trojaner sbcvvhost_win86 blockiert Windows SystemCode:
ATTFilter Combofix Logfile: |
|
23.12.2011, 20:09
| #8 |
| /// Malware-holic | Trojaner sbcvvhost_win86 blockiert Windows System öffne computer, c: dann qoobox, rechtsklcik quarantain, mit winrar oder anderem archivirungsprogramm packen und nach anleitung hochladen. http://www.trojaner-board.de/54791-a...ner-board.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Trojaner sbcvvhost_win86 blockiert Windows System |
| 7-zip, avira, benutzerregistrierung, bho, bildschirm, bitte warten, blockiert, c:\windows\system32\cmd.exe, canon, checkpoint, conduit, desktop, disabletaskmgr, error, excel, excel.exe, fehler, firefox, flash player, home, install.exe, intranet, intrusion prevention, logfile, microsoft office word, nicht öffnen, nvlddmkm.sys, packard bell, problem, realtek, registry, sbcvvhost_win86, scan, sched.exe, security, software, symantec, system, trojaner, usb, vista, windows, windows system |
Linear-Darstellung
