| |
| |||||||
Log-Analyse und Auswertung: smart fortress 2012, wie entfernen?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
18.04.2012, 21:04
| #16 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  smart fortress 2012, wie entfernen? Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
19.04.2012, 20:42
| #17 |
 | smart fortress 2012, wie entfernen? ComboFix habe ich ausgeführt. Jetzt habe ich auf dem Desktop dort wo das Symbol von Combofix war das Symbol vom IE. Kann ich das einfach löschen und warum wurde das dort erstellt?
__________________Hier das Log Combofix Logfile: Code:
ATTFilter ComboFix 12-04-19.01 - Janet 19.04.2012 19:09:20.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2047.1132 [GMT 2:00]
ausgeführt von:: c:\users\Janet\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\windows\security\Database\tmp.edb
c:\windows\unin0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-03-19 bis 2012-04-19 ))))))))))))))))))))))))))))))
.
.
2012-04-19 19:11 . 2012-04-19 19:11 -------- d-----w- c:\users\Janet\AppData\Local\temp
2012-04-19 19:11 . 2012-04-19 19:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-17 18:21 . 2012-04-17 18:21 -------- d-----w- C:\_OTL
2012-04-16 16:23 . 2012-02-28 01:58 141112 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-04-16 16:23 . 2012-02-28 01:08 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2012-04-16 16:23 . 2012-02-28 01:13 678912 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-04-15 23:30 . 2012-02-13 13:44 1068544 ----a-w- c:\windows\system32\DWrite.dll
2012-04-15 23:30 . 2012-02-14 15:45 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-04-15 23:30 . 2012-02-13 14:12 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-04-15 23:30 . 2012-02-14 15:45 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-04-15 23:30 . 2012-02-13 13:47 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-04-15 20:41 . 2012-04-15 20:41 -------- d-----w- c:\program files\ESET
2012-04-15 17:58 . 2012-04-15 17:58 -------- d-----w- c:\program files\Windows Portable Devices
2012-04-15 16:24 . 2009-10-01 01:02 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2012-04-15 16:24 . 2009-10-01 01:01 40448 ----a-w- c:\windows\system32\drivers\WpdUsb.sys
2012-04-15 16:24 . 2009-10-01 01:01 839168 ----a-w- c:\windows\system32\drivers\UMDF\WpdMtpDr.dll
2012-04-15 16:12 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-15 15:32 . 2012-04-15 15:32 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2012-04-15 15:32 . 2012-04-15 15:32 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-04-15 15:32 . 2012-04-15 15:32 478720 ----a-w- c:\windows\system32\dxgi.dll
2012-04-15 15:32 . 2012-04-15 15:32 37376 ----a-w- c:\windows\system32\cdd.dll
2012-04-15 15:32 . 2012-04-15 15:32 189952 ----a-w- c:\windows\system32\d3d10core.dll
2012-04-15 15:32 . 2012-04-15 15:32 1029120 ----a-w- c:\windows\system32\d3d10.dll
2012-04-15 15:30 . 2012-04-15 15:30 519680 ----a-w- c:\windows\system32\d3d11.dll
2012-04-15 15:30 . 2012-04-15 15:30 252928 ----a-w- c:\windows\system32\dxdiag.exe
2012-04-15 15:30 . 2012-04-15 15:30 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2012-04-15 13:31 . 2011-11-17 06:48 440192 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-04-15 13:30 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2012-04-15 13:28 . 2011-10-25 15:56 49152 ----a-w- c:\windows\system32\csrsrv.dll
2012-04-15 13:28 . 2011-09-20 21:02 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-04-15 13:28 . 2011-10-14 16:02 429056 ----a-w- c:\windows\system32\EncDec.dll
2012-04-15 13:28 . 2011-08-13 04:43 6144 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2012-04-15 13:13 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-04-15 13:11 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-04-15 13:08 . 2012-01-09 13:58 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-14 22:08 . 2012-04-14 22:09 -------- d-----w- c:\windows\system32\ca-ES
2012-04-14 22:08 . 2012-04-14 22:09 -------- d-----w- c:\windows\system32\eu-ES
2012-04-14 21:13 . 2009-04-10 21:27 57856 ----a-w- c:\windows\system32\compcln.exe
2012-04-14 21:09 . 2009-04-10 21:28 941056 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
2012-04-14 21:08 . 2009-04-10 21:28 75264 ----a-w- c:\windows\system32\dot3msm.dll
2012-04-14 21:07 . 2009-04-10 21:27 513000 ----a-w- c:\program files\Windows Defender\MpSoftEx.dll
2012-04-14 21:06 . 2009-04-10 19:38 17408 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2012-04-14 21:05 . 2009-04-10 21:28 735232 ----a-w- c:\program files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe
2012-04-14 20:57 . 2012-04-14 20:57 -------- d-----w- c:\windows\system32\EventProviders
2012-04-14 20:08 . 2012-04-14 20:08 -------- d-----w- c:\users\Janet\AppData\Roaming\InstallShield
2012-04-14 19:18 . 2012-04-14 19:18 -------- d-----w- c:\program files\7-Zip
2012-04-14 10:25 . 2012-04-14 10:25 -------- d-----w- c:\users\Janet\AppData\Roaming\Malwarebytes
2012-04-14 10:24 . 2012-04-14 10:24 -------- d-----w- c:\programdata\Malwarebytes
2012-04-14 10:24 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-14 10:24 . 2012-04-14 10:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-12 18:10 . 2012-04-12 18:10 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2012-04-02 18:04 . 2012-04-10 18:25 -------- d-----w- c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-17 19:58 . 2011-12-10 21:01 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-04-15 15:34 . 2012-04-15 15:34 161792 ----a-w- c:\windows\system32\msls31.dll
2012-04-15 15:34 . 2012-04-15 15:34 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-04-15 15:34 . 2012-04-15 15:34 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-04-15 15:34 . 2012-04-15 15:34 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-04-15 15:34 . 2012-04-15 15:34 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-04-15 15:34 . 2012-04-15 15:34 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-04-15 15:34 . 2012-04-15 15:34 367104 ----a-w- c:\windows\system32\html.iec
2012-04-15 15:34 . 2012-04-15 15:34 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-04-15 15:34 . 2012-04-15 15:34 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-04-15 15:34 . 2012-04-15 15:34 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-04-15 15:34 . 2012-04-15 15:34 152064 ----a-w- c:\windows\system32\wextract.exe
2012-04-15 15:34 . 2012-04-15 15:34 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-04-15 15:34 . 2012-04-15 15:34 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-04-15 15:34 . 2012-04-15 15:34 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-04-15 15:34 . 2012-04-15 15:34 11776 ----a-w- c:\windows\system32\mshta.exe
2012-04-15 15:34 . 2012-04-15 15:34 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-04-15 15:32 . 2012-04-15 15:32 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2012-04-15 15:32 . 2012-04-15 15:32 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2012-04-15 15:32 . 2012-04-15 15:32 98816 ----a-w- c:\windows\system32\mfps.dll
2012-04-15 15:32 . 2012-04-15 15:32 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2012-04-15 15:32 . 2012-04-15 15:32 2873344 ----a-w- c:\windows\system32\mf.dll
2012-04-15 15:32 . 2012-04-15 15:32 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2012-04-15 15:32 . 2012-04-15 15:32 209920 ----a-w- c:\windows\system32\mfplat.dll
2012-04-15 15:32 . 2012-04-15 15:32 586240 ----a-w- c:\windows\system32\stobject.dll
2012-04-15 15:32 . 2012-04-15 15:32 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2012-04-15 15:32 . 2012-04-15 15:32 258048 ----a-w- c:\windows\system32\winspool.drv
2012-04-15 15:32 . 2012-04-15 15:32 847360 ----a-w- c:\windows\system32\OpcServices.dll
2012-04-15 15:32 . 2012-04-15 15:32 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-04-15 15:32 . 2012-04-15 15:32 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-04-15 15:32 . 2012-04-15 15:32 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2012-04-15 15:30 . 2012-04-15 15:30 4096 ----a-w- c:\windows\system32\drivers\de-DE\dxgkrnl.sys.mui
2012-04-15 15:30 . 2012-04-15 15:30 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2012-04-15 15:30 . 2012-04-15 15:30 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2012-04-15 15:30 . 2012-04-15 15:30 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2012-04-15 15:30 . 2012-04-15 15:30 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2012-04-12 18:10 . 2012-01-04 19:39 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-06 06:39 . 2012-04-15 15:58 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-06 06:39 . 2012-04-15 15:58 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-02-29 15:11 . 2012-04-15 16:12 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-15 16:12 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-15 16:12 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-28 01:18 . 2012-04-16 16:23 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-16 16:23 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-16 16:23 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-16 16:23 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-23 08:18 . 2010-01-14 21:10 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-07 09:02 . 2012-02-07 09:02 1070352 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-02-02 15:16 . 2012-04-15 13:29 2044416 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-19 39408]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\BullGuard.exe" [2008-04-13 308552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-13 308552]
"RtHDVCpl"="RtHDVCpl.exe" [2007-11-14 4706304]
"Skytel"="Skytel.exe" [2007-10-11 1826816]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-07 220160]
"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\users\Janet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2012\mshaktuell.exe [2012-2-5 1370224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 253600]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2008-01-08 1302368]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard REG_MULTI_SZ BgMainSvc BsFileScan BsMailProxy
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 18:10]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = about:blank
mSearch Bar = hxxp://www.google.com/ie
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Felder mit Bestellhelfer ausfüllen - file://c:\program files\DHL\DHL Bestellhelfer\fillFormContext.html
IE: Felder mit Bestellhelfer merken - file://c:\program files\DHL\DHL Bestellhelfer\assignContext.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4
Trusted Zone: fernuni-hagen.de\ca
Trusted Zone: fernuni-hagen.de\pos
TCP: Interfaces\{0A534F7E-8C94-48C5-ADAD-357149947882}: NameServer = 213.191.74.19 62.109.123.197
DPF: {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} - hxxp://www.psapoll.com/CopyGuardIE.cab
DPF: {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} - hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab
FF - ProfilePath - c:\users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\jnqba3oc.default\
FF - prefs.js: browser.startup.homepage - hxxp://alice.aol.de/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-EADM - c:\program files\Electronic Arts\EADM\EADMUI\EADMUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-19 21:11
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
.
c:\users\Janet\AppData\Local\Temp\catchme.dll 53248 bytes executable
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-19 21:26:21
ComboFix-quarantined-files.txt 2012-04-19 19:26
.
Vor Suchlauf: 13 Verzeichnis(se), 265.264.746.496 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 265.086.435.328 Bytes frei
.
- - End Of File - - 83B289E7881AE19CA35B838E1E96BE97
Geändert von Janet (19.04.2012 um 21:36 Uhr) |
|
20.04.2012, 11:22
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | smart fortress 2012, wie entfernen? Combofix - Scripten
__________________1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter Folder::
c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ |
|
20.04.2012, 20:02
| #19 |
| | smart fortress 2012, wie entfernen? Hier das CF Log Code:
ATTFilter ComboFix 12-04-19.01 - Janet 20.04.2012 18:38:28.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2047.1006 [GMT 2:00]
ausgeführt von:: c:\users\Janet\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Janet\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E
c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E\F4D55F2C00016056000AD65EEEC1FB6E
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-03-20 bis 2012-04-20 ))))))))))))))))))))))))))))))
.
.
2012-04-20 18:37 . 2012-04-20 18:38 -------- d-----w- c:\users\Janet\AppData\Local\temp
2012-04-20 18:37 . 2012-04-20 18:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-17 18:21 . 2012-04-17 18:21 -------- d-----w- C:\_OTL
2012-04-16 16:23 . 2012-02-28 01:58 141112 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-04-16 16:23 . 2012-02-28 01:08 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2012-04-16 16:23 . 2012-02-28 01:13 678912 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-04-16 16:23 . 2012-02-28 01:11 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-04-15 23:30 . 2012-02-13 13:44 1068544 ----a-w- c:\windows\system32\DWrite.dll
2012-04-15 23:30 . 2012-02-14 15:45 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-04-15 23:30 . 2012-02-13 14:12 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-04-15 23:30 . 2012-02-14 15:45 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-04-15 23:30 . 2012-02-13 13:47 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-04-15 20:41 . 2012-04-15 20:41 -------- d-----w- c:\program files\ESET
2012-04-15 17:58 . 2012-04-15 17:58 -------- d-----w- c:\program files\Windows Portable Devices
2012-04-15 16:24 . 2009-10-01 01:02 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2012-04-15 16:24 . 2009-10-01 01:01 40448 ----a-w- c:\windows\system32\drivers\WpdUsb.sys
2012-04-15 16:24 . 2009-10-01 01:01 839168 ----a-w- c:\windows\system32\drivers\UMDF\WpdMtpDr.dll
2012-04-15 16:12 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-15 16:12 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-15 15:32 . 2012-04-15 15:32 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2012-04-15 15:32 . 2012-04-15 15:32 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-04-15 15:32 . 2012-04-15 15:32 478720 ----a-w- c:\windows\system32\dxgi.dll
2012-04-15 15:32 . 2012-04-15 15:32 37376 ----a-w- c:\windows\system32\cdd.dll
2012-04-15 15:32 . 2012-04-15 15:32 189952 ----a-w- c:\windows\system32\d3d10core.dll
2012-04-15 15:32 . 2012-04-15 15:32 1029120 ----a-w- c:\windows\system32\d3d10.dll
2012-04-15 15:30 . 2012-04-15 15:30 519680 ----a-w- c:\windows\system32\d3d11.dll
2012-04-15 15:30 . 2012-04-15 15:30 252928 ----a-w- c:\windows\system32\dxdiag.exe
2012-04-15 15:30 . 2012-04-15 15:30 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2012-04-15 13:31 . 2011-11-17 06:48 440192 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-04-15 13:30 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2012-04-15 13:28 . 2011-10-25 15:56 49152 ----a-w- c:\windows\system32\csrsrv.dll
2012-04-15 13:28 . 2011-09-20 21:02 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-04-15 13:28 . 2011-10-14 16:02 429056 ----a-w- c:\windows\system32\EncDec.dll
2012-04-15 13:28 . 2011-08-13 04:43 6144 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2012-04-15 13:13 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-04-15 13:11 . 2011-09-30 15:57 707584 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-04-15 13:08 . 2012-01-09 13:58 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-14 22:08 . 2012-04-14 22:09 -------- d-----w- c:\windows\system32\ca-ES
2012-04-14 22:08 . 2012-04-14 22:09 -------- d-----w- c:\windows\system32\eu-ES
2012-04-14 21:13 . 2009-04-10 21:27 57856 ----a-w- c:\windows\system32\compcln.exe
2012-04-14 21:09 . 2009-04-10 21:28 941056 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
2012-04-14 21:08 . 2009-04-10 21:28 75264 ----a-w- c:\windows\system32\dot3msm.dll
2012-04-14 21:07 . 2009-04-10 21:27 513000 ----a-w- c:\program files\Windows Defender\MpSoftEx.dll
2012-04-14 21:06 . 2009-04-10 19:38 17408 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2012-04-14 21:05 . 2009-04-10 21:28 735232 ----a-w- c:\program files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe
2012-04-14 20:57 . 2012-04-14 20:57 -------- d-----w- c:\windows\system32\EventProviders
2012-04-14 20:08 . 2012-04-14 20:08 -------- d-----w- c:\users\Janet\AppData\Roaming\InstallShield
2012-04-14 19:18 . 2012-04-14 19:18 -------- d-----w- c:\program files\7-Zip
2012-04-14 10:25 . 2012-04-14 10:25 -------- d-----w- c:\users\Janet\AppData\Roaming\Malwarebytes
2012-04-14 10:24 . 2012-04-14 10:24 -------- d-----w- c:\programdata\Malwarebytes
2012-04-14 10:24 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-14 10:24 . 2012-04-14 10:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-12 18:10 . 2012-04-12 18:10 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-17 19:58 . 2011-12-10 21:01 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-04-15 15:34 . 2012-04-15 15:34 161792 ----a-w- c:\windows\system32\msls31.dll
2012-04-15 15:34 . 2012-04-15 15:34 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-04-15 15:34 . 2012-04-15 15:34 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-04-15 15:34 . 2012-04-15 15:34 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-04-15 15:34 . 2012-04-15 15:34 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-04-15 15:34 . 2012-04-15 15:34 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-04-15 15:34 . 2012-04-15 15:34 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-04-15 15:34 . 2012-04-15 15:34 152064 ----a-w- c:\windows\system32\wextract.exe
2012-04-15 15:34 . 2012-04-15 15:34 11776 ----a-w- c:\windows\system32\mshta.exe
2012-04-15 15:32 . 2012-04-15 15:32 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2012-04-15 15:32 . 2012-04-15 15:32 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2012-04-15 15:32 . 2012-04-15 15:32 98816 ----a-w- c:\windows\system32\mfps.dll
2012-04-15 15:32 . 2012-04-15 15:32 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2012-04-15 15:32 . 2012-04-15 15:32 2873344 ----a-w- c:\windows\system32\mf.dll
2012-04-15 15:32 . 2012-04-15 15:32 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2012-04-15 15:32 . 2012-04-15 15:32 209920 ----a-w- c:\windows\system32\mfplat.dll
2012-04-15 15:32 . 2012-04-15 15:32 586240 ----a-w- c:\windows\system32\stobject.dll
2012-04-15 15:32 . 2012-04-15 15:32 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2012-04-15 15:32 . 2012-04-15 15:32 258048 ----a-w- c:\windows\system32\winspool.drv
2012-04-15 15:32 . 2012-04-15 15:32 847360 ----a-w- c:\windows\system32\OpcServices.dll
2012-04-15 15:32 . 2012-04-15 15:32 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-04-15 15:32 . 2012-04-15 15:32 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-04-15 15:32 . 2012-04-15 15:32 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2012-04-15 15:30 . 2012-04-15 15:30 4096 ----a-w- c:\windows\system32\drivers\de-DE\dxgkrnl.sys.mui
2012-04-15 15:30 . 2012-04-15 15:30 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2012-04-15 15:30 . 2012-04-15 15:30 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2012-04-15 15:30 . 2012-04-15 15:30 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2012-04-15 15:30 . 2012-04-15 15:30 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2012-04-12 18:10 . 2012-01-04 19:39 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-06 06:39 . 2012-04-15 15:58 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-06 06:39 . 2012-04-15 15:58 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-02-29 15:11 . 2012-04-15 16:12 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-15 16:12 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-02-28 01:18 . 2012-04-16 16:23 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-16 16:23 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-16 16:23 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-23 08:18 . 2010-01-14 21:10 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-07 09:02 . 2012-02-07 09:02 1070352 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-02-02 15:16 . 2012-04-15 13:29 2044416 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-19 39408]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\BullGuard.exe" [2008-04-13 308552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-13 308552]
"RtHDVCpl"="RtHDVCpl.exe" [2007-11-14 4706304]
"Skytel"="Skytel.exe" [2007-10-11 1826816]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-07 220160]
"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\users\Janet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2012\mshaktuell.exe [2012-2-5 1370224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 253600]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2008-01-08 1302368]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard REG_MULTI_SZ BgMainSvc BsFileScan BsMailProxy
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 18:10]
.
2012-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]
.
2012-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = about:blank
mSearch Bar = hxxp://www.google.com/ie
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Felder mit Bestellhelfer ausfüllen - file://c:\program files\DHL\DHL Bestellhelfer\fillFormContext.html
IE: Felder mit Bestellhelfer merken - file://c:\program files\DHL\DHL Bestellhelfer\assignContext.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4
Trusted Zone: fernuni-hagen.de\ca
Trusted Zone: fernuni-hagen.de\pos
TCP: Interfaces\{0A534F7E-8C94-48C5-ADAD-357149947882}: NameServer = 62.109.123.197 213.191.74.19
DPF: {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} - hxxp://www.psapoll.com/CopyGuardIE.cab
DPF: {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} - hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab
FF - ProfilePath - c:\users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\jnqba3oc.default\
FF - prefs.js: browser.startup.homepage - hxxp://alice.aol.de/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-20 20:37
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-20 20:52:13
ComboFix-quarantined-files.txt 2012-04-20 18:51
ComboFix2.txt 2012-04-19 19:26
.
Vor Suchlauf: 19 Verzeichnis(se), 264.175.034.368 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 264.176.742.400 Bytes frei
.
- - End Of File - - 22283F06F0A310FD6D009E34F54F01B2
|
|
20.04.2012, 20:57
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | smart fortress 2012, wie entfernen? Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen: 1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen! 2.) Ordner Quarantine in C:\Qoobox in eine Datei zippen 3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! 4.) Wenns erfolgreich war Bescheid sagen 5.) Erst dann wieder den Virenscanner einschalten
__________________ Logfiles bitte immer in CODE-Tags posten |
|
20.04.2012, 21:22
| #21 |
| | smart fortress 2012, wie entfernen? Ich habe den Ordner gerade hochgeladen. |
|
20.04.2012, 22:56
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | smart fortress 2012, wie entfernen? Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes: Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.04.2012, 19:35
| #23 |
| | smart fortress 2012, wie entfernen? Hallo Arne, ich wollte mich nur kurz melden. Leider habe ich privat sehr viel zu tun und bin daher nicht dazu gekommen hier weiter zu machen. Daher kommen meine Antworten in den nächsten Tagen etwas später. Ich hoffe, dass dies ok für Dich ist. Heute habe ich GMER ausprobiert. Leider stürzt es im normalen und abgesicherten Modus ab. Ich mache dann morgen oder übermorgen mit OSAM weiter. Janet |
|
25.04.2012, 20:10
| #24 |
| | smart fortress 2012, wie entfernen? Ich kann osam nicht ausführen bzw. nicht mal entpacken. Beim entpacken zeigen mir 7-Zip und Winrar an, dass die Datei mfc80u.dll beschädigt ist. Code:
ATTFilter
! C:\Users\Janet\Downloads\osam_autorun_manager_5_0_portable.rar: CRC-Fehler in mfc80u.dll. Die Datei ist fehlerhaft.
! C:\Users\Janet\Downloads\osam_autorun_manager_5_0_portable.rar: Unerwartetes Archivende.
|
|
25.04.2012, 20:42
| #25 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | smart fortress 2012, wie entfernen? Du musst den Virenscanner vor dem Entpacken abschalten Evtl. ist das RAR-Achiv von OSAM auch fehlerhaft übertragen worden einfach nochmal neu runterladen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.04.2012, 20:54
| #26 |
| | smart fortress 2012, wie entfernen? Hier das Log von osam: OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 21:50:55 on 25.04.2012 OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [AppInit DLLs] -----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )----- "AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "Ddbaccpl.cpl" - "DataDesign AG" - C:\Windows\system32\Ddbaccpl.cpl "ddBACCTM.cpl" - "DataDesign AG" - C:\Windows\system32\ddBACCTM.cpl "FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys (File found, but it contains no detailed information) "BullGuard Email Monitor" (Reconn) - "BullGuard Ltd." - C:\Program Files\BullGuard Software\BullGuard\reconn.sys "BullGuard File Monitor Driver" (BdFileSpy) - "BullGuard Ltd." - C:\Windows\system32\drivers\BdFileSpy.sys "catchme" (catchme) - ? - C:\Users\Janet\AppData\Local\Temp\catchme.sys (File not found) "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys (File found, but it contains no detailed information) "PDNMp50 NDIS Protocol Driver" (PDNMp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\system32\drivers\PDNMp50.sys "PDNSp50 NDIS Protocol Driver" (PDNSp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\system32\drivers\PDNSp50.sys "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\Display\nvui.dll {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? - (File not found | COM-object registry key not found) {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll {00020d75-0000-0000-c000-000000000046} "lnkfile" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - c:\program files\real\realplayer\rpshell.dll {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (HTTP value) -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} "ActiveFormX Element" - ? - C:\PROGRA~1\KPSA-H~1\axOPL.ocx (File not found) / hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} "CopyGuardCtrl Class" - "Penn, Schoen & Berland Associates, LLC" - C:\Windows\Downloaded Program Files\CopyGuardIE.dll / hxxp://www.psapoll.com/CopyGuardIE.cab {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} "Java Plug-in 1.6.0_04" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_31.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash11e.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab {1E54D648-B804-468d-BC78-4AFFED8E262E} "System Requirements Lab Class" - "Husdawg, LLC" - C:\Windows\Downloaded Program Files\sysreqlab_srl.dll / hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab {1E54D648-B804-468d-BC78-4AFFED8E262F} "System Requirements Lab Class" - "Husdawg, LLC" - C:\Windows\Downloaded Program Files\sysreqlab_nvd.dll / hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab {17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab {6414512B-B978-451D-A0D8-FCFDF33E833C} "WUWebControl Class" - "Microsoft Corporation" - C:\Windows\system32\wuweb.dll / hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228413342227 {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? - (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? - (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll {23BC42E9-46AB-481f-A200-69524B689A6B} "DHL Bestellhelfer" - ? - (File not found | COM-object registry key not found) "eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (HTTP value) {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll {3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - c:\program files\real\realplayer\rpbrowserrecordplugin.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Shortcut exists | File exists) "desktop.ini" - ? - C:\Users\Janet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "WISO Mein Steuer-Sparbuch heute.lnk" - "Buhl Tax Service, Hannover" - C:\Program Files\WISO\Steuersoftware 2012\mshaktuell.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "BullGuard" - "BullGuard Software" - "C:\Program Files\BullGuard Software\BullGuard\BullGuard.exe" "swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" "BullGuard" - "BullGuard Software" - "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe" -boot "Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup "iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe" "QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" "toolbar_eula_launcher" - " " - C:\Program Files\GoogleEULA\EULALauncher.exe [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe "Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe "BullGuard Email Monitoring Service" (BsMailProxy) - "BullGuard Ltd." - C:\Program Files\BullGuard Software\BullGuard\BsMailProxy.dll "BullGuard File Scan Service" (BsFileScan) - "BullGuard Ltd." - C:\Program Files\BullGuard Software\BullGuard\BsFileScan.dll "BullGuard LiveUpdate" (BGLiveSvc) - "BullGuard Software" - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe "BullGuard Main Service" (BgMainSvc) - "BullGuard, Ltd." - C:\Program Files\BullGuard Software\BullGuard\BsMain.dll "Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe "Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe "GnabService" (GnabService) - "Empolis GmbH" - c:\program files\common files\gnab\service\servicecontroller.exe "Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe "Google Update Service (gupdate1c99423b8ae4260)" (gupdate1c99423b8ae4260) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "GoogleDesktopManager" (GoogleDesktopManager) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe "NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "Sceneo PVR Service" (srvcPVR) - "Buhl Data Service GmbH" - C:\Program Files\Sceneo\AbsolutTV\Services\PVR\PVRService.exe "X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== Soll ich gleich mit aswmbr weiter machen oder wertest Du erst das Log aus? |
|
25.04.2012, 20:57
| #27 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | smart fortress 2012, wie entfernen? Die anderen Logs kannst du sofort erstelle
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.04.2012, 21:44
| #28 |
| | smart fortress 2012, wie entfernen? Hier das Log Code:
ATTFilter
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-25 22:00:50
-----------------------------
22:00:50.849 OS Version: Windows 6.0.6002 Service Pack 2
22:00:50.864 Number of processors: 2 586 0xF0B
22:00:50.864 ComputerName: JANET-PC UserName: Janet
22:01:28.835 Initialize success
22:02:35.779 AVAST engine defs: 12042500
22:03:30.566 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000008c
22:03:30.566 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 6
22:03:30.582 Disk 0 MBR read successfully
22:03:30.582 Disk 0 MBR scan
22:03:30.691 Disk 0 Windows VISTA default MBR code
22:03:30.691 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 456456 MB offset 63
22:03:30.707 Disk 0 Partition - 00 0F Extended LBA 20481 MB offset 934822350
22:03:30.738 Disk 0 Partition 2 00 0B FAT32 MSDOS5.0 20481 MB offset 934822413
22:03:30.738 Disk 0 scanning sectors +976768065
22:03:30.800 Disk 0 scanning C:\Windows\system32\drivers
22:03:49.879 Service scanning
22:04:23.887 Modules scanning
22:04:35.540 Disk 0 trace - called modules:
22:04:35.556 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
22:04:35.556 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b6eac8]
22:04:35.556 3 CLASSPNP.SYS[881ac8b3] -> nt!IofCallDriver -> [0x84479950]
22:04:35.571 5 acpi.sys[806a06bc] -> nt!IofCallDriver -> \Device\0000008c[0x84e2a8f8]
22:04:36.492 AVAST engine scan C:\Windows
22:04:46.117 AVAST engine scan C:\Windows\system32
22:10:33.546 AVAST engine scan C:\Windows\system32\drivers
22:10:58.911 AVAST engine scan C:\Users\Janet
22:29:15.669 AVAST engine scan C:\ProgramData
22:36:13.001 Scan finished successfully
22:39:27.003 Disk 0 MBR has been saved successfully to "C:\Users\Janet\Downloads\MBR.dat"
22:39:27.034 The log file has been saved successfully to "C:\Users\Janet\Downloads\aswMBR.txt"
|
|
26.04.2012, 09:25
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | smart fortress 2012, wie entfernen? Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.04.2012, 20:40
| #30 |
| | smart fortress 2012, wie entfernen? Hier kommt das Log von Superantispyware: Code:
ATTFilter
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 04/30/2012 at 09:37 PM
Application Version : 5.0.1148
Core Rules Database Version : 8530
Trace Rules Database Version: 6342
Scan type : Complete Scan
Total Scan Time : 02:43:19
Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Administrator
Memory items scanned : 882
Memory threats detected : 0
Registry items scanned : 36607
Registry threats detected : 0
File items scanned : 233554
File threats detected : 12
Adware.Tracking Cookie
C:\Users\Janet\AppData\Roaming\Microsoft\Windows\Cookies\9Q6M39VF.txt [ /maxis.112.2o7.net ]
C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\6LZE4G7F.txt [ Cookie:janet@apmebf.com/ ]
C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\BG6MJAWI.txt [ Cookie:janet@fl01.ct2.comclick.com/ ]
C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\JHWFJ4RP.txt [ Cookie:janet@ad.yieldmanager.com/ ]
C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\9DX9LPYK.txt [ Cookie:janet@doubleclick.net/ ]
C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\JHL1EUPR.txt [ Cookie:janet@adfarm1.adition.com/ ]
C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\ADZ0XQUY.txt [ Cookie:janet@clickandbuy.com/ ]
C:\USERS\JANET\Cookies\9Q6M39VF.txt [ Cookie:janet@maxis.112.2o7.net/ ]
.divx.112.2o7.net [ C:\USERS\JANET\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
delivery.ibanner.de [ C:\USERS\JANET\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\UKLYYJVA ]
Trojan.Agent/Gen-Bancos
C:\PROGRAM FILES\SCENEO\ABSOLUTTV\BDSUPDATE.DLL
Trojan.Agent/Gen-FakeAV
C:\PROGRAM FILES\WINRAR\DEFAULT.SFX
|
|
| Themen zu smart fortress 2012, wie entfernen? |
| administrator, automatisch, autostart, bluescreen, computer, computern, dateien, dateisystem, entfernen, explorer, falsche, forum, frage, heuristiks/extra, heuristiks/shuriken, hängt, icon, internet, log, malwarebytes, neustart, ordner, prozesse, rechner, scan, sehr laut, system, systemsteuerung, vista, wie entfernen, wie entfernen? |
Linear-Darstellung
