| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: möglicher Viren oder Trojanerbefall..Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
10.01.2012, 19:25
| #1 |
| |  möglicher Viren oder Trojanerbefall.. meine Windows 7 Installation auf der dritten Partition einer Festplatte lässt sich nicht mehr starten, weder im abgesicherten Modus, noch sonstwie. hängt beim Aufruf des Treibers AVGIDSEH.sys oder fvevol.sys (wenn ich AVG2011 Verzeichnisse gelöscht habe). Äuffällig war mir dass bei der Anzeige der geladenen Treiber, die wo das System dann blockierte, mit %Systemroot\Windows\System32\DRIVERS\xxxx.sys aufgerufen wird (Großbuchstaben bei DRIVERS) während die anderen mit %Systemroot%\Windows\System32\drivers\yyyyyyyy.sys geladen werden.. Häng mal mein gmer.log hier an und bitte um Überprüfung... GMER 1.0.15.15641 - hxxp://www.gmer.net Rootkit scan 2012-01-10 07:18:49 Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD5000AAJS-98YFA0 rev.12.01C02 Running: hzkvfd4j.exe; Driver: C:\Users\WernerB\AppData\Local\Temp\pwryapod.sys ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Internet Explorer\iexplore.exe[2068] kernel32.dll!CreateThread 7674CB2E 5 Bytes JMP 6F327303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!SetWindowsHookExW 76A087AD 5 Bytes JMP 6F362194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!CallNextHookEx 76A08E3B 5 Bytes JMP 6F387BB7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!UnhookWindowsHookEx 76A098DB 5 Bytes JMP 6F3AEB74 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!EnableWindow 76A0CD8B 5 Bytes JMP 6F369A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!DefWindowProcA 76A0DB88 7 Bytes JMP 6F32952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!CreateWindowExA 76A0DC2A 5 Bytes JMP 6F333363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!CreateWindowExW 76A11305 5 Bytes JMP 6F38FF8F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!DefWindowProcW 76A203B4 7 Bytes JMP 6F387C1A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!DialogBoxParamW 76A310B0 5 Bytes JMP 6F2C170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!DialogBoxIndirectParamW 76A32EF5 5 Bytes JMP 6F4B62BE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!DialogBoxParamA 76A48152 5 Bytes JMP 6F4B6259 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!DialogBoxIndirectParamA 76A4847D 5 Bytes JMP 6F4B6323 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!MessageBoxIndirectA 76A5D4D9 5 Bytes JMP 6F4B61E0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!MessageBoxIndirectW 76A5D5D3 5 Bytes JMP 6F4B6167 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!MessageBoxExA 76A5D639 5 Bytes JMP 6F4B6103 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] USER32.dll!MessageBoxExW 76A5D65D 5 Bytes JMP 6F4B609F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] ole32.dll!OleLoadFromStream 76451E80 5 Bytes JMP 6F4B6A8C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] WS2_32.dll!closesocket 767E330C 5 Bytes JMP 6A37EEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] WS2_32.dll!recv 767E343A 5 Bytes JMP 6A37F1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] WS2_32.dll!socket 767E36D1 5 Bytes JMP 6A37E59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] WS2_32.dll!connect 767E40D9 5 Bytes JMP 6A37E62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] WS2_32.dll!getaddrinfo 767E418A 5 Bytes JMP 6A37E71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2068] WS2_32.dll!send 767E659B 5 Bytes JMP 6A37E9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!EnableWindow 76A0CD8B 5 Bytes JMP 6F369A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!DialogBoxParamW 76A310B0 5 Bytes JMP 6F2C170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!DialogBoxIndirectParamW 76A32EF5 5 Bytes JMP 6F4B62BE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!DialogBoxParamA 76A48152 5 Bytes JMP 6F4B6259 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!DialogBoxIndirectParamA 76A4847D 5 Bytes JMP 6F4B6323 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!MessageBoxIndirectA 76A5D4D9 5 Bytes JMP 6F4B61E0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!MessageBoxIndirectW 76A5D5D3 5 Bytes JMP 6F4B6167 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!MessageBoxExA 76A5D639 5 Bytes JMP 6F4B6103 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3024] USER32.dll!MessageBoxExW 76A5D65D 5 Bytes JMP 6F4B609F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] kernel32.dll!CreateThread 7674CB2E 5 Bytes JMP 6F327303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!SetWindowsHookExW 76A087AD 5 Bytes JMP 6F362194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!CallNextHookEx 76A08E3B 5 Bytes JMP 6F387BB7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!UnhookWindowsHookEx 76A098DB 5 Bytes JMP 6F3AEB74 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!EnableWindow 76A0CD8B 5 Bytes JMP 6F369A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!DefWindowProcA 76A0DB88 7 Bytes JMP 6F32952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!CreateWindowExA 76A0DC2A 5 Bytes JMP 6F333363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!CreateWindowExW 76A11305 5 Bytes JMP 6F38FF8F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!DefWindowProcW 76A203B4 7 Bytes JMP 6F387C1A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!DialogBoxParamW 76A310B0 5 Bytes JMP 6F2C170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!DialogBoxIndirectParamW 76A32EF5 5 Bytes JMP 6F4B62BE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!DialogBoxParamA 76A48152 5 Bytes JMP 6F4B6259 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!DialogBoxIndirectParamA 76A4847D 5 Bytes JMP 6F4B6323 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!MessageBoxIndirectA 76A5D4D9 5 Bytes JMP 6F4B61E0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!MessageBoxIndirectW 76A5D5D3 5 Bytes JMP 6F4B6167 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!MessageBoxExA 76A5D639 5 Bytes JMP 6F4B6103 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] USER32.dll!MessageBoxExW 76A5D65D 5 Bytes JMP 6F4B609F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] ole32.dll!OleLoadFromStream 76451E80 5 Bytes JMP 6F4B6A8C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] WS2_32.dll!closesocket 767E330C 5 Bytes JMP 6A37EEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] WS2_32.dll!recv 767E343A 5 Bytes JMP 6A37F1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] WS2_32.dll!socket 767E36D1 5 Bytes JMP 6A37E59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] WS2_32.dll!connect 767E40D9 5 Bytes JMP 6A37E62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] WS2_32.dll!getaddrinfo 767E418A 5 Bytes JMP 6A37E71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5072] WS2_32.dll!send 767E659B 5 Bytes JMP 6A37E9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] kernel32.dll!CreateThread 7674CB2E 5 Bytes JMP 6F327303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!SetWindowsHookExW 76A087AD 5 Bytes JMP 6F362194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CallNextHookEx 76A08E3B 5 Bytes JMP 6F387BB7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!UnhookWindowsHookEx 76A098DB 5 Bytes JMP 6F3AEB74 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!EnableWindow 76A0CD8B 5 Bytes JMP 6F369A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DefWindowProcA 76A0DB88 7 Bytes JMP 6F32952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateWindowExA 76A0DC2A 5 Bytes JMP 6F333363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!CreateWindowExW 76A11305 5 Bytes JMP 6F38FF8F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DefWindowProcW 76A203B4 7 Bytes JMP 6F387C1A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxParamW 76A310B0 5 Bytes JMP 6F2C170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxIndirectParamW 76A32EF5 5 Bytes JMP 6F4B62BE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxParamA 76A48152 5 Bytes JMP 6F4B6259 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!DialogBoxIndirectParamA 76A4847D 5 Bytes JMP 6F4B6323 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxIndirectA 76A5D4D9 5 Bytes JMP 6F4B61E0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxIndirectW 76A5D5D3 5 Bytes JMP 6F4B6167 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxExA 76A5D639 5 Bytes JMP 6F4B6103 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] USER32.dll!MessageBoxExW 76A5D65D 5 Bytes JMP 6F4B609F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] ole32.dll!OleLoadFromStream 76451E80 5 Bytes JMP 6F4B6A8C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WS2_32.dll!closesocket 767E330C 5 Bytes JMP 6A37EEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WS2_32.dll!recv 767E343A 5 Bytes JMP 6A37F1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WS2_32.dll!socket 767E36D1 5 Bytes JMP 6A37E59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WS2_32.dll!connect 767E40D9 5 Bytes JMP 6A37E62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WS2_32.dll!getaddrinfo 767E418A 5 Bytes JMP 6A37E71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5264] WS2_32.dll!send 767E659B 5 Bytes JMP 6A37E9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] kernel32.dll!CreateThread 7674CB2E 5 Bytes JMP 6F327303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!SetWindowsHookExW 76A087AD 5 Bytes JMP 6F362194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!CallNextHookEx 76A08E3B 5 Bytes JMP 6F387BB7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!UnhookWindowsHookEx 76A098DB 5 Bytes JMP 6F3AEB74 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!EnableWindow 76A0CD8B 5 Bytes JMP 6F369A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!DefWindowProcA 76A0DB88 7 Bytes JMP 6F32952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!CreateWindowExA 76A0DC2A 5 Bytes JMP 6F333363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!CreateWindowExW 76A11305 5 Bytes JMP 6F38FF8F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!DefWindowProcW 76A203B4 7 Bytes JMP 6F387C1A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!DialogBoxParamW 76A310B0 5 Bytes JMP 6F2C170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!DialogBoxIndirectParamW 76A32EF5 5 Bytes JMP 6F4B62BE C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!DialogBoxParamA 76A48152 5 Bytes JMP 6F4B6259 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!DialogBoxIndirectParamA 76A4847D 5 Bytes JMP 6F4B6323 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!MessageBoxIndirectA 76A5D4D9 5 Bytes JMP 6F4B61E0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!MessageBoxIndirectW 76A5D5D3 5 Bytes JMP 6F4B6167 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!MessageBoxExA 76A5D639 5 Bytes JMP 6F4B6103 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] USER32.dll!MessageBoxExW 76A5D65D 5 Bytes JMP 6F4B609F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] ole32.dll!OleLoadFromStream 76451E80 5 Bytes JMP 6F4B6A8C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] WS2_32.dll!closesocket 767E330C 5 Bytes JMP 6A37EEE9 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] WS2_32.dll!recv 767E343A 5 Bytes JMP 6A37F1C3 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] WS2_32.dll!socket 767E36D1 5 Bytes JMP 6A37E59E C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] WS2_32.dll!connect 767E40D9 5 Bytes JMP 6A37E62A C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] WS2_32.dll!getaddrinfo 767E418A 5 Bytes JMP 6A37E71D C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5716] WS2_32.dll!send 767E659B 5 Bytes JMP 6A37E9ED C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll (Microsoft Search Note/Microsoft Corporation) ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74607817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7465A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7460BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [745FF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [746075E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [745FE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74638395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7460DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [745FFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [745FFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [745F71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7468CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7462C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [745FD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [745F6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [745F687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[2056] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74602AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[2068] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [100086E2] C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitcth/Orbitdownloader.com) IAT C:\Program Files\Internet Explorer\iexplore.exe[5072] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [100086E2] C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitcth/Orbitdownloader.com) IAT C:\Program Files\Internet Explorer\iexplore.exe[5264] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [100086E2] C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitcth/Orbitdownloader.com) IAT C:\Program Files\Internet Explorer\iexplore.exe[5716] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [100086E2] C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitcth/Orbitdownloader.com) ---- Devices - GMER 1.0.15 ---- Device Ntfs.sys (NT-Dateisystemtreiber/Microsoft Corporation) Device lfsfilt.sys (NDAS LFS Filter/XIMETA, Inc.) Device udfs.sys (UDF File System Driver/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 VMkbd.sys AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 VMkbd.sys AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) Device \Driver\usbuhci \Device\USBFDO-0 hcmon.sys Device \Driver\usbuhci \Device\USBFDO-1 hcmon.sys Device \Driver\usbhub \Device\0000006d hcmon.sys Device \Driver\usbuhci \Device\USBFDO-2 hcmon.sys Device \Driver\usbhub \Device\0000006e hcmon.sys Device \Driver\usbuhci \Device\USBFDO-3 hcmon.sys Device \Driver\usbhub \Device\0000006f hcmon.sys Device \Driver\usbehci \Device\USBFDO-4 hcmon.sys Device \FileSystem\cdfs \Cdfs B516E05C ---- Files - GMER 1.0.15 ---- File E:\$WINDOWS.~Q\DATA\Documents and Settings\Mozart.GHO -1720651141 bytes ---- EOF - GMER 1.0.15 ---- Danke Big11 |
|
11.01.2012, 18:55
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | möglicher Viren oder Trojanerbefall.. Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden. Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
| Themen zu möglicher Viren oder Trojanerbefall.. |
| .dll, anzeige, appdata, down, downloader, explorer, explorer.exe, festplatte, gelöscht, gmer.log, harddisk, ide, iexplore.exe, installation, internet, internet explorer, locker, nicht mehr, scan, starten, system, system32, tcp, temp, udp, viren, windows |
Linear-Darstellung
