Seit meinem letzten Virenproblem habe ich sehr darauf geachtet nichts ungewolltes zu installieren. Dabei habe ich jedoch auch wichtige Sicherheitsupdates für Adobe, Java usw nicht zugelassen/installiert. Leider musste ich herausfinden dass es sehr gefährlich ist dies nicht zu tun.
Bemerkt habe ich das Problem nachdem die Framerate meines Laptops vom 15. auf den 16. Mai enorm gesunken ist. Die von Antivir gefundenen Viren sollen angeblich auf Sicherheitslücken und fehlenden Updates von Java basieren. Ich habe im Anhang noch die Logfiles von Malwarebites und Antivir hinzugefügt. Vielen Dank schon mal im voraus und ich hoffe ihr könnt mir helfen. Meine fehlenden Updates habe ich inzwischen mit Secuna nachgeholt.
Defogger Zitat:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:46 on 17/05/2012 (SJ)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
DDS Zitat:
.DDS Logfile: Code:
Alles auswählen Aufklappen ATTFilter
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_31
Run by SJ at 16:51:36 on 2012-05-17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.1811 [GMT 2:00]
.
AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATK Hotkey\MsgTranAgt.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ATK Hotkey\HControlUser.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\RtHDVCpl.exe
D:\Programme\devolo\dlan\devolonetsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ATK Hotkey\WDC.exe
D:\Programme\PSI\PSIA.exe
C:\Windows\system32\svchost.exe -k imgsvc
D:\Programme\Office12\ONENOTEM.EXE
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
D:\Programme\PSI\sua.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
D:\Programme\PSI\psi_tray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about :blank
uDefault_Page_URL = hxxp://www.asus.com
mDefault_Page_URL = hxxp://www.asus.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Steam] "d:\programme\steam\steam.exe" -silent
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [HControlUser] "c:\program files\atk hotkey\HcontrolUser.exe"
mRun: [ATKOSD2] "c:\program files\atkosd2\ATKOSD2.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Skytel] Skytel.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\users\sj\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - d:\programme\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\SECUNI~1.LNK -
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Nach Microsoft E&xel exportieren - d:\progra~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - d:\progra~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{955EBE07-84AE-4F35-865B-4F479AD3984B} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C7089383-A2EA-46DB-97B1-1DF8E6661D43} : DhcpNameServer = 192.168.1.1
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\sj\appdata\roaming\mozilla\firefox\profiles\b3681hv7.default\
FF - prefs.js: browser.startup.homepage - about :home
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll
FF - plugin: d:\programme\reader\browser\nppdf32.dll
.
============= SERVICES / DRIVERS ===============
.
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-4-4 63928]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2011-5-14 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-5-14 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-5-14 66616]
R2 DevoloNetworkService;devolo Network Service;d:\programme\devolo\dlan\devolonetsvc.exe [2010-7-19 2231616]
R2 FontCache;Windows-Dienst für Schriftartencache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
R2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\system32\drivers\npf_devolo.sys [2010-6-10 35840]
R2 Secunia PSI Agent;Secunia PSI Agent;d:\programme\psi\psia.exe --start-service --> d:\programme\psi\PSIA.exe --start-service [?]
R2 Secunia Update Agent;Secunia Update Agent;d:\programme\psi\sua.exe --start-service --> d:\programme\psi\sua.exe --start-service [?]
R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\drivers\NETw5v32.sys [2011-5-15 3658752]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-5-17 257696]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-05-17 01:02:57 -------- d-----w- c:\users\sj\appdata\local\Secunia PSI
2012-05-16 23:02:20 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-15 16:39:11 6734704 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{229919e2-9829-4b3d-a08b-a03b5ddd58ca}\mpengine.dll
2012-04-30 12:33:50 -------- d-----w- c:\program files\common files\Steam
2012-04-28 22:24:51 -------- d-----w- c:\program files\29.4.2012
2012-04-28 22:11:33 -------- d-----w- c:\program files\AMD 29.4.2012
2012-04-28 21:56:41 -------- d-----w- c:\program files\Microsoft
2012-04-28 21:54:38 -------- d-----w- c:\program files\Motorola
.
==================== Find3M ====================
.
2012-05-17 11:36:43 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-16 23:02:20 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 13:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-03 08:16:12 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-03 08:16:11 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-02 13:36:21 2044928 ----a-w- c:\windows\system32\win32k.sys
2012-03-30 12:39:11 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-20 23:28:50 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-03-01 14:46:01 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-03-01 14:46:01 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-02-29 15:11:45 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11:42 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09:53 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 14:08:47 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-02-29 13:44:50 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-02-29 13:41:40 1069056 ----a-w- c:\windows\system32\DWrite.dll
2012-02-29 13:32:37 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-02-28 15:26:16 834048 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 14:21:25 389632 ----a-w- c:\windows\system32\html.iec
2012-02-28 13:56:50 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-23 08:18:36 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-20 17:44:48 80896 ----a-w- c:\program files\Zip.SFX
2012-02-20 17:44:48 74752 ----a-w- c:\program files\WinCon.SFX
2012-02-20 17:44:48 100864 ----a-w- c:\program files\Default.SFX
2012-02-17 19:55:39 123904 ----a-w- c:\program files\Uninstall.exe
2012-02-17 19:55:37 193536 ----a-w- c:\program files\RarExt64.dll
2012-02-17 19:55:35 166912 ----a-w- c:\program files\RarExt.dll
2012-02-17 19:54:56 266240 ----a-w- c:\program files\UnRAR.exe
2012-02-17 19:54:52 403968 ----a-w- c:\program files\Rar.exe
2012-02-17 19:54:46 1150464 ----a-w- c:\program files\WinRAR.exe
.
============= FINISH: 16:52:31,28 ===============
--- --- ---