| |
| |||||||
Log-Analyse und Auswertung: Trojaner: Hijackthis nicht vollständig möglichWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
03.03.2012, 22:29
| #16 |
| /// Selecta Jahrusso   |  Trojaner: Hijackthis nicht vollständig möglich Lade dir das Tool Avenger und speichere es auf dem Desktop: 
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
03.03.2012, 22:47
| #17 |
 | Trojaner: Hijackthis nicht vollständig möglich Hallo,
__________________hab alles gemacht wie beschrieben. Pc startete auch neu allerdings gab es kein File unter C:\avenger.txt. Was ist hier schiefgelaufen? Soll ich wiederholen? |
|
04.03.2012, 01:09
| #18 |
| /// Selecta Jahrusso | Trojaner: Hijackthis nicht vollständig möglich Versuchen wir was anderes.
__________________Downloade dir bitte Farbar's Recovery Scan Tool x64 und speichere diese auf einen USB Stick. Schließe den USB Stick an das infizierte System an Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager
Mit Windows CD/DVD
Wähle in den Reparaturoptionen Eingabeaufforderung
__________________ |
|
04.03.2012, 09:59
| #19 |
| | Trojaner: Hijackthis nicht vollständig möglich Scan result of Farbar Recovery Scan Tool Version: 29-02-2012 01 Ran by SYSTEM at 04-03-2012 09:27:44 Running from G:\ Windows 7 Home Premium (X64) OS Language: German Standard The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [9644576 2009-12-15] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated) HKLM\...\Run: [Acer ePower Management] C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [860704 2010-03-17] (Acer Incorporated) HKLM\...\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden" [1116136 2010-05-26] (Check Point Software Technologies) HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [258560 2010-03-08] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2011-09-07] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED [588648 2009-07-24] (Symantec Corporation) HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-03-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1300560 2010-03-03] (Dritek System Inc.) HKLM-x32\...\Run: [ZoneAlarm Client] "C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [1043968 2010-06-23] (Check Point Software Technologies LTD) HKLM-x32\...\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe [2077536 2012-01-26] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-29] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-09-08] (Apple Inc.) HKLM-x32\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [395144 2011-05-17] (Ask) HKLM-x32\...\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-28] () HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.) HKU\PB\...\Run: [Software Informer] "C:\Program Files (x86)\Software Informer\softinfo.exe" -autorun [2285637 2010-04-22] (Informer Technologies, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 AppInit_DLLs: C:\Windows\System32\avgrssta.dll ==================== Services (Whitelisted) ====== 2 avg9emc; "C:\Program Files (x86)\AVG\AVG9\avgemc.exe" [921952 2010-09-15] (AVG Technologies CZ, s.r.o.) 2 avg9wd; "C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe" [308136 2010-09-15] (AVG Technologies CZ, s.r.o.) 2 DsiWMIService; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [325200 2010-03-03] (Dritek System Inc.) 2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [866336 2010-03-17] (Acer Incorporated) 3 GameConsoleService; "C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsoleService.exe" [238328 2009-10-09] (WildTangent, Inc.) 2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) 2 IswSvc; "C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe" [823272 2010-05-26] (Check Point Software Technologies) 3 Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [935208 2010-01-15] (Nero AG) 3 nosGetPlusHelper; C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll [66112 2010-09-01] (NOS Microsystems Ltd.) 2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [250368 2010-03-08] (NewTech Infosystems, Inc.) 2 TeamViewer7; C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2984832 2011-12-14] (TeamViewer GmbH) 2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232 2010-01-28] (Acer Group) 2 vsmon; C:\Windows\SysWOW64\ZoneLabs\vsmon.exe -service [2435592 2010-06-23] (Check Point Software Technologies LTD) 3 AdobeActiveFileMonitor8.0; c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [x] ========================== Drivers (Whitelisted) ============= 3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [6405632 2010-03-28] (ATI Technologies Inc.) 2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-10-07] () 1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [269904 2010-09-15] (AVG Technologies CZ, s.r.o.) 1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2011-09-12] (AVG Technologies CZ, s.r.o.) 1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2011-05-06] (AVG Technologies CZ, s.r.o.) 3 BridgeMP; C:\Windows\System32\DRIVERS\bridge.sys [95232 2009-07-13] (Microsoft Corporation) 2 ISWKL; \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33008 2010-05-26] (Check Point Software Technologies) 2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-10-07] () 3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [848384 2011-02-10] (Realtek Semiconductor Corporation ) 1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [458840 2010-05-15] (Check Point Software Technologies LTD) 3 catchme; \??\C:\ComboFix\catchme.sys [x] 0 cjuzyvti; C:\Windows\System32\drivers\sckupjs.sys [x] ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-03-04 00:15 - 2012-03-04 00:15 - 1382691 ____A C:\Users\PB\Desktop\FRST64.exe 2012-03-03 13:37 - 2012-03-03 13:37 - 0061440 ____A C:\Windows\SysWOW64\Drivers\sckupjs.sys 2012-03-03 13:37 - 2012-03-03 13:37 - 0000096 ____A C:\Windows\usfshbrw.txt 2012-03-03 13:35 - 2012-03-03 13:35 - 0731136 ____A C:\Users\PB\Desktop\avenger.exe 2012-03-03 11:45 - 2012-03-03 11:45 - 0000000 __SHD C:\$RECYCLE.BIN 2012-03-03 11:44 - 2012-03-03 11:44 - 0024481 ____A C:\Users\PB\Desktop\ComboFix2.txt 2012-03-03 11:42 - 2012-03-03 11:42 - 0024481 ____A C:\ComboFix.txt 2012-03-03 08:17 - 2012-03-03 11:05 - 4426040 ____R (Swearware) C:\Users\PB\Desktop\ComboFix.exe 2012-03-02 09:26 - 2012-03-03 11:43 - 0000000 ____D C:\Qoobox 2012-03-02 09:26 - 2012-03-02 09:46 - 0000000 ____D C:\Windows\ERDNT 2012-03-02 09:26 - 2011-06-25 22:45 - 0256000 ____A C:\Windows\PEV.exe 2012-03-02 09:26 - 2010-11-07 09:20 - 0208896 ____A C:\Windows\MBR.exe 2012-03-02 09:26 - 2009-04-19 20:56 - 0060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2012-03-02 09:26 - 2000-08-30 16:00 - 0518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2012-03-02 09:26 - 2000-08-30 16:00 - 0406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2012-03-02 09:26 - 2000-08-30 16:00 - 0098816 ____A C:\Windows\sed.exe 2012-03-02 09:26 - 2000-08-30 16:00 - 0080412 ____A C:\Windows\grep.exe 2012-03-02 09:26 - 2000-08-30 16:00 - 0068096 ____A C:\Windows\zip.exe 2012-03-02 00:23 - 2012-03-02 00:25 - 0078226 ____A C:\Users\PB\Desktop\TDSSKiller.2.7.17.0_02.03.2012_09.23.53_log.txt 2012-03-02 00:23 - 2012-03-02 00:23 - 0006352 ____A C:\Users\PB\Desktop\Attach.txt 2012-03-02 00:22 - 2012-03-02 00:22 - 0022466 ____A C:\Users\PB\Desktop\DDS.txt 2012-03-02 00:19 - 2012-03-02 00:21 - 2063920 ____A (Kaspersky Lab ZAO) C:\Users\PB\Desktop\tdsskiller.exe 2012-03-02 00:19 - 2012-03-02 00:20 - 0607260 ____R (Swearware) C:\Users\PB\Desktop\dds.com 2012-03-01 12:12 - 2012-03-01 12:13 - 0014041 ____A C:\Users\PB\Downloads\hijackthis.log 2012-03-01 12:07 - 2012-03-01 12:08 - 0388608 ____A (Trend Micro Inc.) C:\Users\PB\Downloads\HiJackThis204.exe 2012-03-01 12:00 - 2012-03-01 12:30 - 99334664 ____A C:\Users\PB\Downloads\mwav.exe 2012-03-01 11:57 - 2012-03-01 12:00 - 3628016 ____A (Piriform Ltd) C:\Users\PB\Downloads\ccsetup316.exe 2012-03-01 11:54 - 2012-03-01 12:13 - 74920720 ____A C:\Users\PB\Downloads\setup_av_free.exe 2012-02-29 23:50 - 2012-02-29 23:51 - 0159572 ____A C:\Windows\ntbtlog.txt 2012-02-29 23:50 - 2012-02-29 22:57 - 0400936 ____A (2q3wet Corporation) C:\Windows\System32\gema.exe 2012-02-20 11:13 - 2012-02-20 11:13 - 0019949 ____A C:\Users\PB\Downloads\Paketschein.pdf 2012-02-15 23:58 - 2012-02-16 00:01 - 0000000 ____D C:\096de57424e4453e871e 2012-02-14 23:46 - 2012-01-04 02:44 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-02-14 23:46 - 2012-01-04 02:44 - 0509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll 2012-02-14 23:46 - 2012-01-04 00:59 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-02-14 23:46 - 2012-01-04 00:58 - 0442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll 2012-02-14 23:44 - 2012-01-13 20:06 - 3145728 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-02-14 23:44 - 2011-12-29 22:26 - 0515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl 2012-02-14 23:44 - 2011-12-29 21:27 - 0478720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl 2012-02-14 23:44 - 2011-12-27 19:59 - 0498688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys 2012-02-14 23:44 - 2011-12-16 00:47 - 1494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-02-14 23:44 - 2011-12-16 00:47 - 1188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-02-14 23:44 - 2011-12-16 00:47 - 0134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-02-14 23:44 - 2011-12-16 00:46 - 0634880 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll 2012-02-14 23:44 - 2011-12-16 00:45 - 9019904 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-02-14 23:44 - 2011-12-16 00:45 - 2454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-02-14 23:44 - 2011-12-16 00:45 - 12263936 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-02-14 23:44 - 2011-12-16 00:45 - 0702464 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-02-14 23:44 - 2011-12-16 00:45 - 0247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-02-14 23:44 - 2011-12-16 00:45 - 0097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-02-14 23:44 - 2011-12-16 00:45 - 0064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-02-14 23:44 - 2011-12-15 23:54 - 1231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-02-14 23:44 - 2011-12-15 23:54 - 0981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-02-14 23:44 - 2011-12-15 23:54 - 0132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 5997568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 2073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 10992128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 0599552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 0176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-02-14 23:44 - 2011-12-15 23:52 - 0048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-02-14 23:44 - 2011-12-15 22:44 - 1638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-02-14 23:44 - 2011-12-15 22:09 - 1638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb ============ 3 Months Modified Files and Folders ============= 2012-03-04 09:28 - 2012-03-04 09:27 - 0000000 ____D C:\FRST 2012-03-04 00:17 - 2010-09-13 22:57 - 1654802 ____A C:\Windows\WindowsUpdate.log 2012-03-04 00:16 - 2010-09-14 08:47 - 0654400 ____A C:\Windows\System32\perfh007.dat 2012-03-04 00:16 - 2010-09-14 08:47 - 0134976 ____A C:\Windows\System32\perfc007.dat 2012-03-04 00:16 - 2009-07-13 21:13 - 1503658 ____A C:\Windows\System32\PerfStringBackup.INI 2012-03-04 00:15 - 2012-03-04 00:15 - 1382691 ____A C:\Users\PB\Desktop\FRST64.exe 2012-03-04 00:15 - 2010-09-15 10:51 - 0000000 ____D C:\Windows\Internet Logs 2012-03-04 00:13 - 2010-11-29 11:03 - 0001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-03-04 00:13 - 2010-09-17 09:41 - 0000000 ____D C:\Users\PB\AppData\Roaming\Software Informer 2012-03-03 15:00 - 2010-11-29 11:03 - 0001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-03-03 13:46 - 2009-07-13 20:45 - 0009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-03-03 13:46 - 2009-07-13 20:45 - 0009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-03-03 13:39 - 2010-09-15 10:39 - 0000442 ____A C:\Windows\System32\Drivers\etc\hosts.ics 2012-03-03 13:39 - 2010-09-13 22:53 - 3217211392 __ASH C:\hiberfil.sys 2012-03-03 13:39 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT 2012-03-03 13:39 - 2009-07-13 20:51 - 0055343 ____A C:\Windows\setupact.log 2012-03-03 13:37 - 2012-03-03 13:37 - 0061440 ____A C:\Windows\SysWOW64\Drivers\sckupjs.sys 2012-03-03 13:37 - 2012-03-03 13:37 - 0000096 ____A C:\Windows\usfshbrw.txt 2012-03-03 13:36 - 2010-09-15 11:28 - 0000000 ____D C:\Windows\System32\Drivers\Avg 2012-03-03 13:35 - 2012-03-03 13:35 - 0731136 ____A C:\Users\PB\Desktop\avenger.exe 2012-03-03 11:45 - 2012-03-03 11:45 - 0000000 __SHD C:\$RECYCLE.BIN 2012-03-03 11:44 - 2012-03-03 11:44 - 0024481 ____A C:\Users\PB\Desktop\ComboFix2.txt 2012-03-03 11:43 - 2012-03-02 09:26 - 0000000 ____D C:\Qoobox 2012-03-03 11:42 - 2012-03-03 11:42 - 0024481 ____A C:\ComboFix.txt 2012-03-03 11:18 - 2009-07-13 18:34 - 0000215 ____A C:\Windows\system.ini 2012-03-03 11:18 - 2009-07-13 18:34 - 0000027 ____A C:\Windows\System32\Drivers\etc\hosts 2012-03-03 11:17 - 2010-03-30 07:34 - 0257690 ____A C:\Windows\PFRO.log 2012-03-03 11:05 - 2012-03-03 08:17 - 4426040 ____R (Swearware) C:\Users\PB\Desktop\ComboFix.exe 2012-03-02 10:09 - 2009-07-13 19:20 - 0000000 ___RD C:\users\Public 2012-03-02 09:46 - 2012-03-02 09:26 - 0000000 ____D C:\Windows\ERDNT 2012-03-02 00:25 - 2012-03-02 00:23 - 0078226 ____A C:\Users\PB\Desktop\TDSSKiller.2.7.17.0_02.03.2012_09.23.53_log.txt 2012-03-02 00:23 - 2012-03-02 00:23 - 0006352 ____A C:\Users\PB\Desktop\Attach.txt 2012-03-02 00:22 - 2012-03-02 00:22 - 0022466 ____A C:\Users\PB\Desktop\DDS.txt 2012-03-02 00:21 - 2012-03-02 00:19 - 2063920 ____A (Kaspersky Lab ZAO) C:\Users\PB\Desktop\tdsskiller.exe 2012-03-02 00:20 - 2012-03-02 00:19 - 0607260 ____R (Swearware) C:\Users\PB\Desktop\dds.com 2012-03-01 12:13 - 2012-03-01 12:12 - 0014041 ____A C:\Users\PB\Downloads\hijackthis.log 2012-03-01 12:13 - 2012-03-01 11:54 - 74920720 ____A C:\Users\PB\Downloads\setup_av_free.exe 2012-03-01 12:08 - 2012-03-01 12:07 - 0388608 ____A (Trend Micro Inc.) C:\Users\PB\Downloads\HiJackThis204.exe 2012-03-01 12:00 - 2012-03-01 11:57 - 3628016 ____A (Piriform Ltd) C:\Users\PB\Downloads\ccsetup316.exe 2012-03-01 10:17 - 2010-09-15 10:52 - 0420801 ____A C:\Windows\System32\Drivers\vsconfig.xml 2012-02-29 23:51 - 2012-02-29 23:50 - 0159572 ____A C:\Windows\ntbtlog.txt 2012-02-29 23:51 - 2009-07-13 18:34 - 0000444 ____A C:\Windows\win.ini 2012-02-29 23:20 - 2010-09-13 23:05 - 0000000 ____D C:\users\PB 2012-02-29 23:11 - 2011-12-24 06:36 - 0000000 ____D C:\users\Gast 2012-02-29 23:11 - 2010-10-15 11:17 - 0000000 ____D C:\Users\PB\AppData\Roaming\vlc 2012-02-29 23:11 - 2010-10-15 11:17 - 0000000 ____D C:\Program Files (x86)\QuickTime 2012-02-29 23:11 - 2010-09-13 23:08 - 0000000 ____D C:\Users\PB\AppData\Local\VirtualStore 2012-02-29 23:11 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\registration 2012-02-29 23:11 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\AppCompat 2012-02-29 23:05 - 2011-12-24 06:37 - 0000174 ___SH C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2012-02-29 22:57 - 2012-02-29 23:50 - 0400936 ____A (2q3wet Corporation) C:\Windows\System32\gema.exe 2012-02-25 10:41 - 2010-09-15 11:07 - 0000000 ____D C:\Program Files (x86)\Mozilla Firefox 2012-02-20 11:13 - 2012-02-20 11:13 - 0019949 ____A C:\Users\PB\Downloads\Paketschein.pdf 2012-02-20 02:28 - 2010-09-15 13:32 - 0000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2012-02-16 11:18 - 2010-09-13 23:08 - 0000174 ___SH C:\Users\PB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2012-02-16 11:16 - 2010-03-30 07:17 - 0000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2012-02-16 11:16 - 2009-07-13 20:45 - 0367040 ____A C:\Windows\System32\FNTCACHE.DAT 2012-02-16 00:01 - 2012-02-15 23:58 - 0000000 ____D C:\096de57424e4453e871e 2012-02-15 23:58 - 2010-09-24 10:59 - 54585368 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-02-01 13:56 - 2012-02-01 13:03 - 287484615 ____A C:\Users\PB\Downloads\blmh.mp4 2012-01-25 00:07 - 2011-08-15 02:41 - 0000000 ____D C:\Users\All Users\CyberLink 2012-01-25 00:07 - 2011-08-15 02:41 - 0000000 ____D C:\ProgramData\CyberLink 2012-01-23 11:04 - 2012-01-23 11:04 - 0080896 ____A C:\Users\PB\Desktop\the-great-irish-share-valuation-project-i.xls 2012-01-23 11:04 - 2012-01-23 11:04 - 0080384 ____A C:\Users\PB\Downloads\the-great-irish-share-valuation-project-i.xls 2012-01-16 10:28 - 2012-01-16 10:28 - 0027739 ____A C:\Users\PB\Downloads\umsaetze_3144318_20120116-1928.html 2012-01-15 09:42 - 2010-09-26 11:53 - 0000000 ____D C:\Users\PB\AppData\Roaming\BOM 2012-01-13 20:06 - 2012-02-14 23:44 - 3145728 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-01-12 01:38 - 2012-01-12 01:38 - 0028699 ____A C:\Users\PB\Downloads\Finanzreport_Nr.12_vom_31.12.2011742547.pdf 2012-01-12 00:27 - 2012-01-12 00:24 - 0000000 ____D C:\a92cdad5a7dddfa8fcff 2012-01-06 06:32 - 2012-01-06 06:01 - 126336897 ____A C:\Users\PB\Downloads\Super.rar 2012-01-06 05:48 - 2012-01-06 05:46 - 0000000 ____D C:\Users\PB\AppData\Roaming\TeamViewer 2012-01-06 05:35 - 2012-01-06 05:35 - 0001178 ____A C:\Users\Public\Desktop\TeamViewer 7.lnk 2012-01-06 05:35 - 2012-01-06 05:35 - 0000000 ____D C:\Program Files (x86)\TeamViewer 2012-01-06 05:33 - 2012-01-06 05:33 - 4028936 ____A (TeamViewer GmbH) C:\Users\PB\Downloads\TeamViewer_Setup_de.exe 2012-01-04 02:44 - 2012-02-14 23:46 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-01-04 02:44 - 2012-02-14 23:46 - 0509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll 2012-01-04 00:59 - 2012-02-14 23:46 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-01-04 00:58 - 2012-02-14 23:46 - 0442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll 2012-01-01 11:10 - 2012-01-01 11:10 - 0008422 ____A C:\Users\PB\Desktop\Emerging Markets Aktien.ods 2011-12-30 14:27 - 2011-12-30 14:27 - 0000000 ____D C:\Users\PB\Documents\KarinneuerPc 2011-12-29 22:26 - 2012-02-14 23:44 - 0515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl 2011-12-29 21:27 - 2012-02-14 23:44 - 0478720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl 2011-12-27 19:59 - 2012-02-14 23:44 - 0498688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys 2011-12-27 06:15 - 2011-12-24 06:36 - 0000000 ____D C:\Users\Gast\AppData\LocalLow 2011-12-24 06:47 - 2011-12-24 06:47 - 0000000 ____D C:\Users\Gast\AppData\Roaming\Thunderbird 2011-12-24 06:47 - 2011-12-24 06:47 - 0000000 ____D C:\Users\Gast\AppData\Roaming\Adobe 2011-12-24 06:47 - 2011-12-24 06:47 - 0000000 ____D C:\Users\Gast\AppData\Local\Thunderbird 2011-12-24 06:39 - 2011-12-24 06:39 - 0000000 ____D C:\Users\Gast\AppData\Roaming\ATI 2011-12-24 06:39 - 2011-12-24 06:39 - 0000000 ____D C:\Users\Gast\AppData\Local\ATI 2011-12-24 06:38 - 2011-12-24 06:38 - 0084792 ____A C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT 2011-12-24 06:38 - 2011-12-24 06:38 - 0000000 ____D C:\Users\Gast\AppData\Roaming\Macromedia 2011-12-24 06:37 - 2011-12-24 06:37 - 0000000 ____D C:\Users\Gast\Documents\ForceField Shared Files 2011-12-24 06:37 - 2011-12-24 06:37 - 0000000 ____D C:\Users\Gast\AppData\Roaming\Mozilla 2011-12-24 06:37 - 2011-12-24 06:37 - 0000000 ____D C:\Users\Gast\AppData\Local\VirtualStore 2011-12-24 06:37 - 2011-12-24 06:37 - 0000000 ____D C:\Users\Gast\AppData\Local\Mozilla 2011-12-24 06:36 - 2011-12-24 06:36 - 0000020 ___SH C:\Users\Gast\ntuser.ini 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Vorlagen 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Startmenü 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Netzwerkumgebung 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Lokale Einstellungen 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Eigene Dateien 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Druckumgebung 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Documents\Eigene Videos 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Documents\Eigene Musik 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Documents\Eigene Bilder 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\AppData\Local\Verlauf 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\AppData\Local\Temporary Internet Files 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\AppData\Local\Anwendungsdaten 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 __SHD C:\Users\Gast\Anwendungsdaten 2011-12-24 06:36 - 2011-12-24 06:36 - 0000000 ____D C:\Users\Gast\AppData\Roaming\CheckPoint 2011-12-16 00:47 - 2012-02-14 23:44 - 1494016 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2011-12-16 00:47 - 2012-02-14 23:44 - 1188864 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2011-12-16 00:47 - 2012-02-14 23:44 - 0134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2011-12-16 00:46 - 2012-02-14 23:44 - 0634880 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll 2011-12-16 00:45 - 2012-02-14 23:44 - 9019904 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2011-12-16 00:45 - 2012-02-14 23:44 - 2454528 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2011-12-16 00:45 - 2012-02-14 23:44 - 12263936 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2011-12-16 00:45 - 2012-02-14 23:44 - 0702464 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2011-12-16 00:45 - 2012-02-14 23:44 - 0247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2011-12-16 00:45 - 2012-02-14 23:44 - 0097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2011-12-16 00:45 - 2012-02-14 23:44 - 0064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2011-12-15 23:54 - 2012-02-14 23:44 - 1231360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2011-12-15 23:54 - 2012-02-14 23:44 - 0981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2011-12-15 23:54 - 2012-02-14 23:44 - 0132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 5997568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 2073600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 10992128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 0599552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 0176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2011-12-15 23:52 - 2012-02-14 23:44 - 0048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2011-12-15 22:44 - 2012-02-14 23:44 - 1638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2011-12-15 22:09 - 2012-02-14 23:44 - 1638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2011-12-14 19:00 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\rescache 2011-12-14 18:05 - 2011-12-14 18:02 - 0000000 ____D C:\860544809bbce264d5c25850055886 2011-12-14 18:01 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\SysWOW64\de-DE 2011-12-14 18:01 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\de-DE 2011-12-11 10:14 - 2011-05-28 08:33 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2011-12-10 10:55 - 2011-12-10 10:55 - 0000000 ____D C:\Users\PB\Desktop\Aktien 2011-12-08 13:29 - 2011-12-08 13:29 - 0157472 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe 2011-12-08 13:29 - 2011-12-08 13:29 - 0145184 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe 2011-12-08 13:29 - 2011-12-08 13:29 - 0145184 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe 2011-12-08 13:29 - 2010-10-03 09:57 - 0472808 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll 2011-12-08 13:21 - 2011-12-08 13:20 - 0005476 ____A C:\Windows\SysWOW64\jupdate-1.6.0_29-b11.log 2011-12-08 13:21 - 2010-10-03 09:57 - 0000000 ____D C:\Program Files (x86)\Java 2011-12-08 13:16 - 2011-12-08 13:16 - 0910624 ____A (Sun Microsystems, Inc.) C:\Users\PB\Downloads\jxpiinstall.exe ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ========================= Memory info ====================== Percentage of memory in use: 18% Total physical RAM: 4090.9 MB Available physical RAM: 3324.05 MB Total Pagefile: 4089.05 MB Available Pagefile: 3311.48 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: (Packard Bell) (Fixed) (Total:451.66 GB) (Free:219.38 GB) NTFS 2 Drive e: (PQSERVICE) (Fixed) (Total:14 GB) (Free:2.6 GB) NTFS ==>[System with boot components (obtained from reading drive)] 3 Drive f: (Disk) (CDROM) (Total:0.12 GB) (Free:0 GB) CDFS 4 Drive g: (RALLY2) (Removable) (Total:1.87 GB) (Free:1.82 GB) FAT 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 6 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Datentr„ger ### Status Gr”áe Frei Dyn GPT --------------- ------------- ------- ------- --- --- Datentr„ger 0 Online 465 GB 0 B Datentr„ger 1 Online 1912 MB 0 B Datentr„gerpartitionierung wird beendet... Partitions of Disk 0: =============== Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger. Partition ### Typ Gr”áe Offset ------------- ---------------- ------- ------- Partition 1 Wiederherstellun 14 GB 31 KB Partition 2 Prim„r 101 MB 14 GB Partition 3 Prim„r 451 GB 14 GB Datentr„gerpartitionierung wird beendet... ====================================================================================================== Disk: 0 Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger. Partition 1 ist jetzt die gew„hlte Partition. Partition 1 Typ : 27 Versteckt: Ja Aktiv : Nein Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 E PQSERVICE NTFS Partition 14 GB Fehlerfre Versteck Datentr„gerpartitionierung wird beendet... ====================================================================================================== Disk: 0 Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger. Partition 2 ist jetzt die gew„hlte Partition. Partition 2 Typ : 07 Versteckt: Nein Aktiv : Ja Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 Y SYSTEM RESE NTFS Partition 101 MB Fehlerfre Datentr„gerpartitionierung wird beendet... ====================================================================================================== Disk: 0 Datentr„ger 0 ist jetzt der gew„hlte Datentr„ger. Partition 3 ist jetzt die gew„hlte Partition. Partition 3 Typ : 07 Versteckt: Nein Aktiv : Nein Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 C Packard Bel NTFS Partition 451 GB Fehlerfre Datentr„gerpartitionierung wird beendet... ====================================================================================================== Partitions of Disk 1: =============== Datentr„ger 1 ist jetzt der gew„hlte Datentr„ger. Partition ### Typ Gr”áe Offset ------------- ---------------- ------- ------- Partition 1 Prim„r 1911 MB 16 KB Datentr„gerpartitionierung wird beendet... ====================================================================================================== Disk: 1 Datentr„ger 1 ist jetzt der gew„hlte Datentr„ger. Partition 1 ist jetzt die gew„hlte Partition. Partition 1 Typ : 06 Versteckt: Nein Aktiv : Ja Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 4 G RALLY2 FAT Wechselmed 1911 MB Fehlerfre Datentr„gerpartitionierung wird beendet... ====================================================================================================== ========================================================== Last Boot: 2012-03-01 14:03 ======================= End Of Log ========================== |
|
04.03.2012, 14:04
| #20 |
| /// Selecta Jahrusso | Trojaner: Hijackthis nicht vollständig möglich Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Windows\System32\gema.exe
cmd: attrib -s -h "C:\Users\Gast\Vorlagen" /d /s
cmd: attrib -s -h "C:\Users\Gast\Startmenü" /d /s
cmd: attrib -s -h "C:\Users\Gast\Netzwerkumgebung" /d /s
cmd: attrib -s -h "C:\Users\Gast\Lokale Einstellungen" /d /s
cmd: attrib -s -h "C:\Users\Gast\Eigene Dateien" /d /s
cmd: attrib -s -h "C:\Users\Gast\Druckumgebung" /d /s
cmd: attrib -s -h "C:\Users\Gast\Documents\Eigene Videos" /d /s
cmd: attrib -s -h "C:\Users\Gast\Documents\Eigene Musik" /d /s
cmd: attrib -s -h "C:\Users\Gast\Documents\Eigene Bilder" /d /s
cmd: attrib -s -h "C:\Users\Gast\AppData\Local\Verlauf" /d /s
cmd: attrib -s -h "C:\Users\Gast\AppData\Local\Temporary Internet Files" /d /s
cmd: attrib -s -h "C:\Users\Gast\AppData\Local\Anwendungsdaten" /d /s
cmd: attrib -s -h "C:\Users\Gast\Anwendungsdaten" /d /s
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
04.03.2012, 14:54
| #21 |
| | Trojaner: Hijackthis nicht vollständig möglich verstehe ich das richtig so? würde so vorgehen: Über den Boot Manager Starte den Rechner neu auf. Während dem Hochfahren drücke mehrmals die F8 Taste Wähle nun Computer reparieren. Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter" Wähle in den Reparaturoptionen Eingabeaufforderung Gib nun bitte notepad ein und drücke Enter. Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt. Schließe Notepad wieder Gib nun bitte folgenden Befehl ein. e:\frst64.exe Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen. Akzeptiere den Disclaimer mit Yes und klicke Fix |
|
04.03.2012, 21:33
| #22 |
| /// Selecta Jahrusso | Trojaner: Hijackthis nicht vollständig möglich Ja.................
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
04.03.2012, 22:00
| #23 |
| | Trojaner: Hijackthis nicht vollständig möglich Fix result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 29-02-2012 01 Ran by SYSTEM at 2012-03-04 21:58:29 R:1 Running from G:\ ============================================== C:\Windows\System32\gema.exe moved successfully. ========= attrib -s -h "C:\Users\Gast\Vorlagen" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Startmenü" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Netzwerkumgebung" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Lokale Einstellungen" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Eigene Dateien" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Druckumgebung" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Documents\Eigene Videos" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Documents\Eigene Musik" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Documents\Eigene Bilder" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\AppData\Local\Verlauf" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\AppData\Local\Temporary Internet Files" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\AppData\Local\Anwendungsdaten" /d /s ========= ========= End of CMD: ========= ========= attrib -s -h "C:\Users\Gast\Anwendungsdaten" /d /s ========= ========= End of CMD: ========= ==== End of Fixlog ==== |
|
05.03.2012, 13:17
| #24 |
| /// Selecta Jahrusso | Trojaner: Hijackthis nicht vollständig möglich Sieht gut aus. Downloade bitte Grinler's unhide.exe auf deinem Desktop Starte das Tool mit Doppelklick. Wenn es seine Arbeit getan hat, wir eine Nachricht mit Done aufpoppen. Es wird auch eine Logfile, Unhide.txt erstellen. Poste diese bitte hier. Lösche bitte die vorhandene Combofix Version und downloade dir von hier eine neue Version. Speichere diese auf dem Desktop. Gehe sicher, dass all deine Anti Virus und anderen Schutzprogramme abgeschalten sind.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
05.03.2012, 18:54
| #25 |
| | Trojaner: Hijackthis nicht vollständig möglich Unhide by Lawrence Abrams (Grinler) hxxp://www.bleepingcomputer.com/ Copyright 2008-2012 BleepingComputer.com More Information about Unhide.exe can be found at this link: hxxp://www.bleepingcomputer.com/forums/topic405109.html Program started at: 03/05/2012 06:47:37 PM Windows Version: Windows 7 Please be patient while your files are made visible again. Processing the C:\ drive Finished processing the C:\ drive. 252090 files processed. The C:\Users\PB\AppData\Local\Temp\smtmp\ folder does not exist!! Unhide cannot restore your missing shortcuts!! Please see this topic in order to learn how to restore default Start Menu shortcuts: hxxp://www.bleepingcomputer.com/forums/topic405109.html Searching for Windows Registry changes made by FakeHDD rogues. - Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer - Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced No registry changes detected. Program finished at: 03/05/2012 06:53:15 PM Execution time: 0 hours(s), 5 minute(s), and 37 seconds(s) |
|
05.03.2012, 20:55
| #26 |
| /// Selecta Jahrusso | Trojaner: Hijackthis nicht vollständig möglich Und Combofix ?
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
06.03.2012, 18:25
| #27 |
| | Trojaner: Hijackthis nicht vollständig möglich Combofix Logfile: Code:
ATTFilter ComboFix 12-03-04.02 - PB 06.03.2012 7:47.8.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4091.2590 [GMT 1:00]
ausgeführt von:: c:\users\PB\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: ZoneAlarm Firewall *Enabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: AVG Anti-Virus Free *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-02-06 bis 2012-03-06 ))))))))))))))))))))))))))))))
.
.
2012-03-06 06:54 . 2012-03-06 06:54 -------- d-----w- c:\users\Gast\AppData\Local\temp
2012-03-06 06:54 . 2012-03-06 06:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-04 17:27 . 2012-03-04 17:29 -------- d-----w- C:\FRST
2012-03-03 21:37 . 2012-03-03 21:37 61440 ----a-w- c:\windows\SysWow64\drivers\sckupjs.sys
2012-02-16 07:58 . 2012-02-16 08:01 -------- d-----w- C:\096de57424e4453e871e
2012-02-15 07:46 . 2012-01-04 10:44 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-15 07:46 . 2012-01-04 08:58 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-11 18:14 . 2011-05-28 16:33 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-08 21:29 . 2010-10-03 17:57 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2006-05-03 10:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-03-02_17.43.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-03-06 06:55 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-03-02 17:41 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-03-02 17:41 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-06 06:55 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-03-02 17:41 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-06 06:55 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-30 15:36 . 2012-03-05 23:06 36750 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-03-06 06:34 45026 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-09-14 07:25 . 2012-03-06 06:34 14060 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2542434425-1258955176-3825240953-1000_UserData.bin
+ 2010-09-14 07:02 . 2012-03-06 06:57 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-14 07:02 . 2012-03-02 17:08 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-09-14 07:02 . 2012-03-02 17:08 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-09-14 07:02 . 2012-03-06 06:57 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-06 06:57 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2012-03-02 17:08 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-15 17:50 . 2012-03-01 19:36 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-15 17:50 . 2012-03-06 06:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-15 17:50 . 2012-03-06 06:57 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-09-15 17:50 . 2012-03-01 19:36 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-09-15 17:50 . 2012-03-06 06:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-15 17:50 . 2012-03-01 19:36 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-15 15:49 . 2012-03-02 17:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-15 15:49 . 2012-03-06 07:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-15 15:49 . 2012-03-06 07:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-15 15:49 . 2012-03-02 17:42 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-09-28 22:26 . 2012-03-03 19:44 3032 c:\windows\system32\wdi\ERCQueuedResolutions.dat
- 2012-03-02 17:41 . 2012-03-02 17:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-06 06:55 . 2012-03-06 06:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-06 06:55 . 2012-03-06 06:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-03-02 17:41 . 2012-03-02 17:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-09-15 17:47 . 2012-03-06 02:25 352328 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2012-03-06 06:59 616242 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-03-01 19:41 616242 c:\windows\system32\perfh009.dat
+ 2010-09-14 16:47 . 2012-03-06 06:59 654400 c:\windows\system32\perfh007.dat
- 2010-09-14 16:47 . 2012-03-01 19:41 654400 c:\windows\system32\perfh007.dat
+ 2009-07-14 02:36 . 2012-03-06 06:59 106622 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-03-01 19:41 106622 c:\windows\system32\perfc009.dat
- 2010-09-14 16:47 . 2012-03-01 19:41 134976 c:\windows\system32\perfc007.dat
+ 2010-09-14 16:47 . 2012-03-06 06:59 134976 c:\windows\system32\perfc007.dat
- 2009-07-14 05:12 . 2012-03-02 17:08 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2012-03-06 06:57 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:01 . 2012-03-06 06:54 355028 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-03-02 17:40 355028 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-22 16:36 . 2012-03-06 06:54 1062460 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2542434425-1258955176-3825240953-1000-8192.dat
- 2011-02-22 16:36 . 2012-03-02 17:40 1062460 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2542434425-1258955176-3825240953-1000-8192.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files (x86)\ZoneAlarm\tbZon1.dll" [2011-11-13 2735200]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
"{667f86f1-c684-4aba-97a5-be7d02ea5156}"= "c:\program files (x86)\P2P_MAX_DE_Atube\tbP2P_.dll" [2009-02-19 2081304]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{667f86f1-c684-4aba-97a5-be7d02ea5156}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}]
2011-04-14 04:37 252832 ----a-w- c:\program files (x86)\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{667f86f1-c684-4aba-97a5-be7d02ea5156}]
2009-02-19 14:58 2081304 ----a-w- c:\program files (x86)\P2P_MAX_DE_Atube\tbP2P_.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
2011-11-13 09:59 2735200 ----a-w- c:\program files (x86)\ZoneAlarm\tbZon1.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-01-17 14:54 175912 ----a-w- c:\program files (x86)\DVDVideoSoftTB\prxtbDVD0.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-05-17 11:29 1490312 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files (x86)\ZoneAlarm\tbZon1.dll" [2011-11-13 2735200]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVD0.dll" [2011-01-17 175912]
"{667f86f1-c684-4aba-97a5-be7d02ea5156}"= "c:\program files (x86)\P2P_MAX_DE_Atube\tbP2P_.dll" [2009-02-19 2081304]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
.
[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{667f86f1-c684-4aba-97a5-be7d02ea5156}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Software Informer"="c:\program files (x86)\Software Informer\softinfo.exe" [2010-04-22 2285637]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" [2010-03-08 258560]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-29 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-03-03 1300560]
"ZoneAlarm Client"="c:\program files (x86)\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
"AVG9_TRAY"="c:\progra~2\AVG\AVG9\avgtray.exe" [2012-01-26 2077536]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-05-17 395144]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\users\PB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-29 135664]
R3 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-10-09 169312]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-29 135664]
R3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 27136]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\Drivers\avgldx64.sys [x]
S1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\Drivers\avgmfx64.sys [x]
S1 AvgTdiA;AVG Free Network Redirector x64;c:\windows\system32\Drivers\avgtdia.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 avg9emc;AVG Free E-mail Scanner;c:\program files (x86)\AVG\AVG9\avgemc.exe [2010-09-15 921952]
S2 avg9wd;AVG Free WatchDog;c:\program files (x86)\AVG\AVG9\avgwdsvc.exe [2010-09-15 308136]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-03-03 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2010-03-17 866336]
S2 GREGService;GREGService;c:\program files (x86)\Packard Bell\Registration\GREGsvc.exe [2010-01-08 23584]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2010-05-26 33008]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2010-05-26 823272]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [2010-03-08 250368]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]
S2 Updater Service;Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2010-01-28 243232]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-29 19:03]
.
2012-03-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-29 19:03]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}]
2011-04-14 04:37 296352 ----a-w- c:\program files (x86)\Mein Gutscheincode Finder\Internet Explorer\x64\ConversionOneIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-15 9644576]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"Acer ePower Management"="c:\program files\Packard Bell\Packard Bell Power Management\ePowerTray.exe" [2010-03-17 860704]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 1116136]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\avgrssta.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.orbitdownloader.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=easynote_tm81&r=27360910g645l0474z195f4522d295
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204
IE: add to &BOM - c:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta
IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202
IE: Free YouTube to Mp3 Converter - c:\users\PB\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\PB\AppData\Roaming\Mozilla\Firefox\Profiles\w8ok2i52.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2611275&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - prefs.js: network.proxy.type - 0
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.search.order.1 - Google
FF - user.js: browser.search.defaultenginename - Google
FF - user.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF - user.js: privacy.item.cookies - false
FF - user.js: privacy.sanitize.promptOnSanitize - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD} - (no file)
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
WebBrowser-{667F86F1-C684-4ABA-97A5-BE7D02EA5156} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\AVG\AVG9\avgcsrvx.exe
c:\windows\System32\Packard Bell.scr
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-06 08:31:20 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-03-06 07:31
ComboFix2.txt 2012-03-03 19:42
ComboFix3.txt 2012-03-03 17:08
ComboFix4.txt 2012-03-02 18:09
.
Vor Suchlauf: 31 Verzeichnis(se), 237.769.637.888 Bytes frei
Nach Suchlauf: 32 Verzeichnis(se), 237.681.786.880 Bytes frei
.
- - End Of File - - C7450AD9EEBA841FF40C3135A9876C9F
|
|
06.03.2012, 18:26
| #28 |
| | Trojaner: Hijackthis nicht vollständig möglich Sorry das es so lange gedauert hat, war beruflich unterwegs. |
|
07.03.2012, 07:37
| #29 |
| /// Selecta Jahrusso | Trojaner: Hijackthis nicht vollständig möglich Hy, Wie läuft der Rechner ? ESET Online Scanner
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
07.03.2012, 20:11
| #30 |
| | Trojaner: Hijackthis nicht vollständig möglich Hi, der Rechner lief nach der Selbstreparatur (bei der ich bis heute nicht weiß wie ich das gemacht habe :-) )bereits auch wieder wie früher (gleiches Tempo, keine Abstürze oder ähnliches) allerdings hatte ich eben kein gutes Gefühl mehr wegen der AVG-Virenmeldung. Hier jetzt das aktuelle Logfile. Spende folgt übrigens in Kürze. Danke schonmal für die Hilfe C:\Downloads\Software\RegistryReviverInstall.exe a variant of Win32/RegistryReviver application C:\Qoobox\Quarantine\[4]-Submit_2012-03-03_17.28.23.zip Win32/LockScreen.AKA trojan C:\Qoobox\Quarantine\C\ProgramData\gema\gema.exe.vir Win32/LockScreen.AKA trojan C:\Qoobox\Quarantine\C\Users\PB\AppData\Roaming\Desktopicon\eBayShortcuts.exe.vir Win32/Adware.ADON application C:\Qoobox\Quarantine\C\Users\PB\AppData\Roaming\gema\gema.exe.vir Win32/LockScreen.AKA trojan C:\Users\PB\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\c5198f-50cdf151 Java/Agent.DW trojan C:\Users\PB\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\258242bd-497dc5c8 Java/Agent.DJ trojan C:\Users\PB\Documents\KarinneuerPc\PDFCreator-1_2_3_setup.exe Win32/Adware.Toolbar.Dealio application C:\Users\PB\Downloads\SoftonicDownloader_fuer_hjsplit.exe a variant of Win32/SoftonicDownloader.A application C:\Users\PB\Downloads\SoftonicDownloader_fuer_super.exe a variant of Win32/SoftonicDownloader.A application C:\Users\PB\Downloads\XvidSetup.exe a variant of Win32/Adware.HotBar.H application |
|
| Themen zu Trojaner: Hijackthis nicht vollständig möglich |
| adobe, avg, bho, bildschirm, conduit, converter, e-mail, explorer, firefox, gema.exe, google, hijack, hijackthis, internet explorer, launch, logfile, monitor, mozilla, mozilla thunderbird, mp3, object, packard bell, plug-in, problem, security, software, super, symantec, system, trojaner, windows, wmi |
Linear-Darstellung
