|
Plagegeister aller Art und deren Bekämpfung: GVU-TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
17.07.2012, 10:20 | #16 |
/// Winkelfunktion /// TB-Süch-Tiger™ | GVU-Trojaner Lad die Datei hier hoch => File-Upload.net - Ihr kostenloser File Hoster! und verlink sie hier
__________________ Logfiles bitte immer in CODE-Tags posten |
17.07.2012, 12:33 | #17 |
| GVU-Trojaner hxxp://www.file-upload.net/download-4565030/MovedFiles.zip.html
__________________ |
18.07.2012, 11:24 | #18 |
/// Winkelfunktion /// TB-Süch-Tiger™ | GVU-Trojaner Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html
__________________Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm! Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs. Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!
__________________ |
20.07.2012, 11:37 | #19 |
| GVU-Trojaner Hier ist das Log vom TDSS-Killer: Code:
ATTFilter 12:27:43.0489 5864 TDSS rootkit removing tool 2.7.46.0 Jul 16 2012 22:10:11 12:27:43.0661 5864 ============================================================ 12:27:43.0661 5864 Current date / time: 2012/07/20 12:27:43.0661 12:27:43.0661 5864 SystemInfo: 12:27:43.0661 5864 12:27:43.0661 5864 OS Version: 6.1.7600 ServicePack: 0.0 12:27:43.0661 5864 Product type: Workstation 12:27:43.0661 5864 ComputerName: JULIA 12:27:43.0661 5864 UserName: Julia 12:27:43.0661 5864 Windows directory: C:\windows 12:27:43.0661 5864 System windows directory: C:\windows 12:27:43.0661 5864 Running under WOW64 12:27:43.0661 5864 Processor architecture: Intel x64 12:27:43.0661 5864 Number of processors: 4 12:27:43.0661 5864 Page size: 0x1000 12:27:43.0661 5864 Boot type: Normal boot 12:27:43.0661 5864 ============================================================ 12:27:44.0098 5864 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 12:27:44.0113 5864 ============================================================ 12:27:44.0113 5864 \Device\Harddisk0\DR0: 12:27:44.0113 5864 MBR partitions: 12:27:44.0113 5864 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1832800, BlocksNum 0x23BFB000 12:27:44.0113 5864 ============================================================ 12:27:44.0144 5864 C: <-> \Device\Harddisk0\DR0\Partition0 12:27:44.0144 5864 ============================================================ 12:27:44.0144 5864 Initialize success 12:27:44.0144 5864 ============================================================ 12:27:52.0085 3736 ============================================================ 12:27:52.0085 3736 Scan started 12:27:52.0085 3736 Mode: Manual; SigCheck; TDLFS; 12:27:52.0085 3736 ============================================================ 12:27:52.0506 3736 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\windows\system32\DRIVERS\1394ohci.sys 12:27:52.0771 3736 1394ohci - ok 12:27:52.0896 3736 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 12:27:52.0927 3736 ACDaemon - ok 12:27:53.0005 3736 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\windows\system32\DRIVERS\ACPI.sys 12:27:53.0037 3736 ACPI - ok 12:27:53.0068 3736 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\windows\system32\DRIVERS\acpipmi.sys 12:27:53.0130 3736 AcpiPmi - ok 12:27:53.0239 3736 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 12:27:53.0255 3736 AdobeARMservice - ok 12:27:53.0427 3736 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 12:27:53.0458 3736 AdobeFlashPlayerUpdateSvc - ok 12:27:53.0520 3736 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\DRIVERS\adp94xx.sys 12:27:53.0583 3736 adp94xx - ok 12:27:53.0661 3736 adpahci (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\DRIVERS\adpahci.sys 12:27:53.0723 3736 adpahci - ok 12:27:53.0754 3736 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\DRIVERS\adpu320.sys 12:27:53.0785 3736 adpu320 - ok 12:27:53.0848 3736 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\windows\System32\aelupsvc.dll 12:27:54.0051 3736 AeLookupSvc - ok 12:27:54.0191 3736 AFD (db9d6c6b2cd95a9ca414d045b627422e) C:\windows\system32\drivers\afd.sys 12:27:54.0285 3736 AFD - ok 12:27:54.0347 3736 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\DRIVERS\agp440.sys 12:27:54.0363 3736 agp440 - ok 12:27:54.0441 3736 ALG (3290d6946b5e30e70414990574883ddb) C:\windows\System32\alg.exe 12:27:54.0487 3736 ALG - ok 12:27:54.0550 3736 aliide (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\DRIVERS\aliide.sys 12:27:54.0581 3736 aliide - ok 12:27:54.0643 3736 amdide (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\DRIVERS\amdide.sys 12:27:54.0659 3736 amdide - ok 12:27:54.0690 3736 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\DRIVERS\amdk8.sys 12:27:54.0721 3736 AmdK8 - ok 12:27:54.0737 3736 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys 12:27:54.0753 3736 AmdPPM - ok 12:27:54.0799 3736 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\windows\system32\drivers\amdsata.sys 12:27:54.0815 3736 amdsata - ok 12:27:54.0877 3736 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\DRIVERS\amdsbs.sys 12:27:54.0924 3736 amdsbs - ok 12:27:54.0987 3736 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\windows\system32\drivers\amdxata.sys 12:27:55.0018 3736 amdxata - ok 12:27:55.0143 3736 AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe 12:27:55.0174 3736 AntiVirSchedulerService - ok 12:27:55.0221 3736 AntiVirService (72d90e56563165984224493069c69ed4) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe 12:27:55.0236 3736 AntiVirService - ok 12:27:55.0267 3736 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\windows\system32\drivers\appid.sys 12:27:55.0361 3736 AppID - ok 12:27:55.0408 3736 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\windows\System32\appidsvc.dll 12:27:55.0501 3736 AppIDSvc - ok 12:27:55.0533 3736 Appinfo (d065be66822847b7f127d1f90158376e) C:\windows\System32\appinfo.dll 12:27:55.0564 3736 Appinfo - ok 12:27:55.0689 3736 Apple Mobile Device (f401929ee0cc92bfe7f15161ca535383) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 12:27:55.0704 3736 Apple Mobile Device - ok 12:27:55.0720 3736 arc (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\DRIVERS\arc.sys 12:27:55.0751 3736 arc - ok 12:27:55.0798 3736 arcsas (019af6924aefe7839f61c830227fe79c) C:\windows\system32\DRIVERS\arcsas.sys 12:27:55.0813 3736 arcsas - ok 12:27:55.0860 3736 ArcSoftKsUFilter (c130bc4a51b1382b2be8e44579ec4c0a) C:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys 12:27:55.0891 3736 ArcSoftKsUFilter - ok 12:27:55.0907 3736 AsyncMac (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys 12:27:55.0985 3736 AsyncMac - ok 12:27:56.0047 3736 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\DRIVERS\atapi.sys 12:27:56.0063 3736 atapi - ok 12:27:56.0141 3736 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\windows\System32\Audiosrv.dll 12:27:56.0219 3736 AudioEndpointBuilder - ok 12:27:56.0235 3736 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\windows\System32\Audiosrv.dll 12:27:56.0281 3736 AudioSrv - ok 12:27:56.0344 3736 avgntflt (b1224e6b086cd6548315b04ab575a23e) C:\windows\system32\DRIVERS\avgntflt.sys 12:27:56.0344 3736 avgntflt - ok 12:27:56.0422 3736 avipbb (ed45f12cfa62b83765c9c1496758cc87) C:\windows\system32\DRIVERS\avipbb.sys 12:27:56.0453 3736 avipbb - ok 12:27:56.0484 3736 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\windows\System32\AxInstSV.dll 12:27:56.0531 3736 AxInstSV - ok 12:27:56.0593 3736 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\windows\system32\DRIVERS\bxvbda.sys 12:27:56.0656 3736 b06bdrv - ok 12:27:56.0718 3736 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys 12:27:56.0765 3736 b57nd60a - ok 12:27:56.0827 3736 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\windows\System32\bdesvc.dll 12:27:56.0874 3736 BDESVC - ok 12:27:56.0905 3736 Beep (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys 12:27:56.0983 3736 Beep - ok 12:27:57.0077 3736 BFE (4992c609a6315671463e30f6512bc022) C:\windows\System32\bfe.dll 12:27:57.0171 3736 BFE - ok 12:27:57.0295 3736 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\windows\System32\qmgr.dll 12:27:57.0373 3736 BITS - ok 12:27:57.0467 3736 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys 12:27:57.0514 3736 blbdrive - ok 12:27:57.0639 3736 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 12:27:57.0670 3736 Bonjour Service - ok 12:27:57.0763 3736 bowser (19d20159708e152267e53b66677a4995) C:\windows\system32\DRIVERS\bowser.sys 12:27:57.0826 3736 bowser - ok 12:27:57.0857 3736 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\DRIVERS\BrFiltLo.sys 12:27:57.0888 3736 BrFiltLo - ok 12:27:57.0888 3736 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\DRIVERS\BrFiltUp.sys 12:27:57.0904 3736 BrFiltUp - ok 12:27:57.0966 3736 Browser (94fbc06f294d58d02361918418f996e3) C:\windows\System32\browser.dll 12:27:58.0044 3736 Browser - ok 12:27:58.0075 3736 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys 12:27:58.0138 3736 Brserid - ok 12:27:58.0138 3736 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys 12:27:58.0185 3736 BrSerWdm - ok 12:27:58.0185 3736 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys 12:27:58.0231 3736 BrUsbMdm - ok 12:27:58.0247 3736 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys 12:27:58.0278 3736 BrUsbSer - ok 12:27:58.0278 3736 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\DRIVERS\bthmodem.sys 12:27:58.0309 3736 BTHMODEM - ok 12:27:58.0341 3736 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\windows\system32\bthserv.dll 12:27:58.0403 3736 bthserv - ok 12:27:58.0465 3736 cdfs (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys 12:27:58.0528 3736 cdfs - ok 12:27:58.0559 3736 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\windows\system32\DRIVERS\cdrom.sys 12:27:58.0606 3736 cdrom - ok 12:27:58.0637 3736 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\windows\System32\certprop.dll 12:27:58.0715 3736 CertPropSvc - ok 12:27:58.0731 3736 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\DRIVERS\circlass.sys 12:27:58.0777 3736 circlass - ok 12:27:58.0871 3736 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys 12:27:58.0902 3736 CLFS - ok 12:27:58.0996 3736 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 12:27:59.0011 3736 clr_optimization_v2.0.50727_32 - ok 12:27:59.0074 3736 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 12:27:59.0105 3736 clr_optimization_v2.0.50727_64 - ok 12:27:59.0183 3736 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 12:27:59.0199 3736 clr_optimization_v4.0.30319_32 - ok 12:27:59.0261 3736 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 12:27:59.0292 3736 clr_optimization_v4.0.30319_64 - ok 12:27:59.0339 3736 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys 12:27:59.0386 3736 CmBatt - ok 12:27:59.0401 3736 cmdide (e19d3f095812725d88f9001985b94edd) C:\windows\system32\DRIVERS\cmdide.sys 12:27:59.0417 3736 cmdide - ok 12:27:59.0557 3736 CNG (ca7720b73446fddec5c69519c1174c98) C:\windows\system32\Drivers\cng.sys 12:27:59.0620 3736 CNG - ok 12:27:59.0698 3736 Compbatt (102de219c3f61415f964c88e9085ad14) C:\windows\system32\DRIVERS\compbatt.sys 12:27:59.0713 3736 Compbatt - ok 12:27:59.0745 3736 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\windows\system32\DRIVERS\CompositeBus.sys 12:27:59.0776 3736 CompositeBus - ok 12:27:59.0791 3736 COMSysApp - ok 12:27:59.0807 3736 crcdisk (1c827878a998c18847245fe1f34ee597) C:\windows\system32\DRIVERS\crcdisk.sys 12:27:59.0823 3736 crcdisk - ok 12:27:59.0901 3736 CryptSvc (f02786b66375292e58c8777082d4396d) C:\windows\system32\cryptsvc.dll 12:27:59.0963 3736 CryptSvc - ok 12:28:00.0041 3736 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\windows\system32\rpcss.dll 12:28:00.0103 3736 DcomLaunch - ok 12:28:00.0166 3736 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\windows\System32\defragsvc.dll 12:28:00.0228 3736 defragsvc - ok 12:28:00.0275 3736 DfsC (9c253ce7311ca60fc11c774692a13208) C:\windows\system32\Drivers\dfsc.sys 12:28:00.0337 3736 DfsC - ok 12:28:00.0369 3736 DgiVecp - ok 12:28:00.0431 3736 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\windows\system32\dhcpcore.dll 12:28:00.0540 3736 Dhcp - ok 12:28:00.0587 3736 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys 12:28:00.0649 3736 discache - ok 12:28:00.0696 3736 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\DRIVERS\disk.sys 12:28:00.0712 3736 Disk - ok 12:28:00.0759 3736 Dnscache (85cf424c74a1d5ec33533e1dbff9920a) C:\windows\System32\dnsrslvr.dll 12:28:00.0805 3736 Dnscache - ok 12:28:00.0868 3736 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\windows\System32\dot3svc.dll 12:28:00.0993 3736 dot3svc - ok 12:28:01.0024 3736 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\windows\system32\dps.dll 12:28:01.0071 3736 DPS - ok 12:28:01.0102 3736 drmkaud (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys 12:28:01.0117 3736 drmkaud - ok 12:28:01.0227 3736 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\windows\System32\drivers\dxgkrnl.sys 12:28:01.0258 3736 DXGKrnl - ok 12:28:01.0305 3736 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\windows\System32\eapsvc.dll 12:28:01.0367 3736 EapHost - ok 12:28:01.0601 3736 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\DRIVERS\evbda.sys 12:28:01.0726 3736 ebdrv - ok 12:28:01.0851 3736 EFS (156f6159457d0aa7e59b62681b56eb90) C:\windows\System32\lsass.exe 12:28:01.0929 3736 EFS - ok 12:28:02.0053 3736 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\windows\ehome\ehRecvr.exe 12:28:02.0131 3736 ehRecvr - ok 12:28:02.0163 3736 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\windows\ehome\ehsched.exe 12:28:02.0194 3736 ehSched - ok 12:28:02.0334 3736 elxstor (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\DRIVERS\elxstor.sys 12:28:02.0365 3736 elxstor - ok 12:28:02.0365 3736 ErrDev (34a3c54752046e79a126e15c51db409b) C:\windows\system32\DRIVERS\errdev.sys 12:28:02.0397 3736 ErrDev - ok 12:28:02.0459 3736 ETD (06c94be9d9e1e6411429433a64a76936) C:\windows\system32\DRIVERS\ETD.sys 12:28:02.0506 3736 ETD - ok 12:28:02.0568 3736 EUCR (89d11159b361dd1eac5dd4e9895c04a4) C:\windows\system32\DRIVERS\EUCR6SK.SYS 12:28:02.0584 3736 EUCR - ok 12:28:02.0646 3736 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\windows\system32\es.dll 12:28:02.0709 3736 EventSystem - ok 12:28:02.0740 3736 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys 12:28:02.0787 3736 exfat - ok 12:28:02.0880 3736 Fabs - ok 12:28:02.0943 3736 fastfat (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys 12:28:03.0021 3736 fastfat - ok 12:28:03.0099 3736 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\windows\system32\fxssvc.exe 12:28:03.0177 3736 Fax - ok 12:28:03.0192 3736 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\DRIVERS\fdc.sys 12:28:03.0223 3736 fdc - ok 12:28:03.0255 3736 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\windows\system32\fdPHost.dll 12:28:03.0317 3736 fdPHost - ok 12:28:03.0333 3736 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\windows\system32\fdrespub.dll 12:28:03.0395 3736 FDResPub - ok 12:28:03.0442 3736 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys 12:28:03.0442 3736 FileInfo - ok 12:28:03.0473 3736 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys 12:28:03.0520 3736 Filetrace - ok 12:28:03.0801 3736 FirebirdServerMAGIXInstance (fff1130f7c9fa01d093a1edfc5cce8fc) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe 12:28:03.0925 3736 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning 12:28:03.0925 3736 FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1) 12:28:04.0066 3736 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\DRIVERS\flpydisk.sys 12:28:04.0097 3736 flpydisk - ok 12:28:04.0144 3736 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\windows\system32\drivers\fltmgr.sys 12:28:04.0175 3736 FltMgr - ok 12:28:04.0284 3736 FontCache (8ac4cb4ea61e41009fae9ae7b2b5da3a) C:\windows\system32\FntCache.dll 12:28:04.0393 3736 FontCache - ok 12:28:04.0471 3736 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 12:28:04.0487 3736 FontCache3.0.0.0 - ok 12:28:04.0549 3736 FsDepends (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys 12:28:04.0581 3736 FsDepends - ok 12:28:04.0659 3736 Fs_Rec (d3e3f93d67821a2db2b3d9fac2dc2064) C:\windows\system32\drivers\Fs_Rec.sys 12:28:04.0674 3736 Fs_Rec - ok 12:28:04.0705 3736 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\windows\system32\DRIVERS\fvevol.sys 12:28:04.0737 3736 fvevol - ok 12:28:04.0768 3736 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\DRIVERS\gagp30kx.sys 12:28:04.0768 3736 gagp30kx - ok 12:28:04.0830 3736 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\windows\system32\DRIVERS\GEARAspiWDM.sys 12:28:04.0830 3736 GEARAspiWDM - ok 12:28:04.0924 3736 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\windows\System32\gpsvc.dll 12:28:04.0986 3736 gpsvc - ok 12:28:05.0080 3736 gusvc (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe 12:28:05.0111 3736 gusvc - ok 12:28:05.0142 3736 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys 12:28:05.0173 3736 hcw85cir - ok 12:28:05.0236 3736 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\windows\system32\drivers\HdAudio.sys 12:28:05.0298 3736 HdAudAddService - ok 12:28:05.0329 3736 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\windows\system32\DRIVERS\HDAudBus.sys 12:28:05.0361 3736 HDAudBus - ok 12:28:05.0392 3736 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\windows\system32\DRIVERS\HECIx64.sys 12:28:05.0407 3736 HECIx64 - ok 12:28:05.0454 3736 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\DRIVERS\HidBatt.sys 12:28:05.0501 3736 HidBatt - ok 12:28:05.0517 3736 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\DRIVERS\hidbth.sys 12:28:05.0532 3736 HidBth - ok 12:28:05.0532 3736 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\DRIVERS\hidir.sys 12:28:05.0563 3736 HidIr - ok 12:28:05.0579 3736 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\windows\system32\hidserv.dll 12:28:05.0626 3736 hidserv - ok 12:28:05.0641 3736 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\windows\system32\DRIVERS\hidusb.sys 12:28:05.0673 3736 HidUsb - ok 12:28:05.0704 3736 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\windows\system32\kmsvc.dll 12:28:05.0751 3736 hkmsvc - ok 12:28:05.0782 3736 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\windows\system32\ListSvc.dll 12:28:05.0907 3736 HomeGroupListener - ok 12:28:05.0938 3736 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\windows\system32\provsvc.dll 12:28:05.0969 3736 HomeGroupProvider - ok 12:28:06.0016 3736 HpSAMD (0886d440058f203eba0e1825e4355914) C:\windows\system32\DRIVERS\HpSAMD.sys 12:28:06.0031 3736 HpSAMD - ok 12:28:06.0125 3736 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\windows\system32\drivers\HTTP.sys 12:28:06.0203 3736 HTTP - ok 12:28:06.0219 3736 hwpolicy (f17766a19145f111856378df337a5d79) C:\windows\system32\drivers\hwpolicy.sys 12:28:06.0219 3736 hwpolicy - ok 12:28:06.0250 3736 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys 12:28:06.0265 3736 i8042prt - ok 12:28:06.0343 3736 iaStor (1384872112e8e7fd5786eceb8bddf4c9) C:\windows\system32\DRIVERS\iaStor.sys 12:28:06.0375 3736 iaStor - ok 12:28:06.0453 3736 IAStorDataMgrSvc (6b24d1c3096de796d15571079ea5e98c) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe 12:28:06.0468 3736 IAStorDataMgrSvc - ok 12:28:06.0546 3736 iaStorV (b75e45c564e944a2657167d197ab29da) C:\windows\system32\drivers\iaStorV.sys 12:28:06.0593 3736 iaStorV - ok 12:28:06.0733 3736 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 12:28:06.0780 3736 idsvc - ok 12:28:07.0373 3736 igfx (2a22ab054f4630d2ef4bab2853f6d5f6) C:\windows\system32\DRIVERS\igdkmd64.sys 12:28:07.0716 3736 igfx - ok 12:28:07.0888 3736 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\DRIVERS\iirsp.sys 12:28:07.0903 3736 iirsp - ok 12:28:08.0013 3736 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\windows\System32\ikeext.dll 12:28:08.0091 3736 IKEEXT - ok 12:28:08.0153 3736 Impcd (dd587a55390ed2295bce6d36ad567da9) C:\windows\system32\DRIVERS\Impcd.sys 12:28:08.0215 3736 Impcd - ok 12:28:08.0403 3736 IntcAzAudAddService (b88e24bd77a0ce2cffee2facf1151be0) C:\windows\system32\drivers\RTKVHD64.sys 12:28:08.0512 3736 IntcAzAudAddService - ok 12:28:08.0715 3736 IntcDAud (58cf58dee26c909bd6f977b61d246295) C:\windows\system32\DRIVERS\IntcDAud.sys 12:28:08.0777 3736 IntcDAud - ok 12:28:08.0839 3736 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\DRIVERS\intelide.sys 12:28:08.0855 3736 intelide - ok 12:28:08.0933 3736 intelppm (ada036632c664caa754079041cf1f8c1) C:\windows\system32\DRIVERS\intelppm.sys 12:28:08.0964 3736 intelppm - ok 12:28:08.0995 3736 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\windows\system32\ipbusenum.dll 12:28:09.0058 3736 IPBusEnum - ok 12:28:09.0089 3736 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\windows\system32\DRIVERS\ipfltdrv.sys 12:28:09.0120 3736 IpFilterDriver - ok 12:28:09.0183 3736 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\windows\System32\iphlpsvc.dll 12:28:09.0261 3736 iphlpsvc - ok 12:28:09.0276 3736 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\windows\system32\DRIVERS\IPMIDrv.sys 12:28:09.0292 3736 IPMIDRV - ok 12:28:09.0370 3736 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys 12:28:09.0448 3736 IPNAT - ok 12:28:09.0635 3736 iPod Service (a9ab99ee7d39725eafec82732d2b3271) C:\Program Files\iPod\bin\iPodService.exe 12:28:09.0682 3736 iPod Service - ok 12:28:09.0697 3736 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys 12:28:09.0729 3736 IRENUM - ok 12:28:09.0760 3736 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\DRIVERS\isapnp.sys 12:28:09.0775 3736 isapnp - ok 12:28:09.0807 3736 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\windows\system32\DRIVERS\msiscsi.sys 12:28:09.0822 3736 iScsiPrt - ok 12:28:09.0885 3736 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys 12:28:09.0916 3736 kbdclass - ok 12:28:09.0963 3736 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\windows\system32\DRIVERS\kbdhid.sys 12:28:10.0009 3736 kbdhid - ok 12:28:10.0041 3736 KeyIso (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe 12:28:10.0056 3736 KeyIso - ok 12:28:10.0134 3736 KSecDD (4f4b5fde429416877de7143044582eb5) C:\windows\system32\Drivers\ksecdd.sys 12:28:10.0150 3736 KSecDD - ok 12:28:10.0212 3736 KSecPkg (6f40465a44ecdc1731befafec5bdd03c) C:\windows\system32\Drivers\ksecpkg.sys 12:28:10.0259 3736 KSecPkg - ok 12:28:10.0306 3736 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys 12:28:10.0384 3736 ksthunk - ok 12:28:10.0446 3736 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\windows\system32\msdtckrm.dll 12:28:10.0524 3736 KtmRm - ok 12:28:10.0587 3736 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\windows\system32\srvsvc.dll 12:28:10.0633 3736 LanmanServer - ok 12:28:10.0680 3736 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\windows\System32\wkssvc.dll 12:28:10.0743 3736 LanmanWorkstation - ok 12:28:10.0774 3736 lltdio (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys 12:28:10.0883 3736 lltdio - ok 12:28:10.0930 3736 lltdsvc (c1185803384ab3feed115f79f109427f) C:\windows\System32\lltdsvc.dll 12:28:11.0023 3736 lltdsvc - ok 12:28:11.0039 3736 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\windows\System32\lmhsvc.dll 12:28:11.0101 3736 lmhosts - ok 12:28:11.0195 3736 LMS (7485fbcef9136f530953575e2977859d) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe 12:28:11.0226 3736 LMS - ok 12:28:11.0273 3736 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\DRIVERS\lsi_fc.sys 12:28:11.0304 3736 LSI_FC - ok 12:28:11.0320 3736 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\DRIVERS\lsi_sas.sys 12:28:11.0335 3736 LSI_SAS - ok 12:28:11.0367 3736 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\DRIVERS\lsi_sas2.sys 12:28:11.0382 3736 LSI_SAS2 - ok 12:28:11.0398 3736 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\DRIVERS\lsi_scsi.sys 12:28:11.0413 3736 LSI_SCSI - ok 12:28:11.0460 3736 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys 12:28:11.0507 3736 luafv - ok 12:28:11.0538 3736 MBfilt (8ff2d95cba49b405c5de27039ff0bf35) C:\windows\system32\drivers\MBfilt64.sys 12:28:11.0538 3736 MBfilt - ok 12:28:11.0601 3736 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\windows\system32\Mcx2Svc.dll 12:28:11.0632 3736 Mcx2Svc - ok 12:28:11.0679 3736 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\DRIVERS\megasas.sys 12:28:11.0694 3736 megasas - ok 12:28:11.0741 3736 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\DRIVERS\MegaSR.sys 12:28:11.0788 3736 MegaSR - ok 12:28:11.0866 3736 MGHwCtrl - ok 12:28:11.0944 3736 Micro Star SCM (71c6748ee8de938532057ef10b4b7e44) C:\Program Files (x86)\System Control Manager\MSIService.exe 12:28:11.0975 3736 Micro Star SCM ( UnsignedFile.Multi.Generic ) - warning 12:28:11.0975 3736 Micro Star SCM - detected UnsignedFile.Multi.Generic (1) 12:28:12.0006 3736 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\windows\system32\mmcss.dll 12:28:12.0069 3736 MMCSS - ok 12:28:12.0100 3736 Modem (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys 12:28:12.0178 3736 Modem - ok 12:28:12.0209 3736 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys 12:28:12.0240 3736 monitor - ok 12:28:12.0271 3736 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys 12:28:12.0287 3736 mouclass - ok 12:28:12.0303 3736 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys 12:28:12.0318 3736 mouhid - ok 12:28:12.0334 3736 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\windows\system32\drivers\mountmgr.sys 12:28:12.0349 3736 mountmgr - ok 12:28:12.0412 3736 MozillaMaintenance (46297fa8e30a6007f14118fc2b942fbc) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 12:28:12.0427 3736 MozillaMaintenance - ok 12:28:12.0474 3736 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\windows\system32\DRIVERS\mpio.sys 12:28:12.0490 3736 mpio - ok 12:28:12.0537 3736 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys 12:28:12.0615 3736 mpsdrv - ok 12:28:12.0693 3736 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\windows\system32\mpssvc.dll 12:28:12.0771 3736 MpsSvc - ok 12:28:12.0802 3736 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\windows\system32\drivers\mrxdav.sys 12:28:12.0833 3736 MRxDAV - ok 12:28:12.0895 3736 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\windows\system32\DRIVERS\mrxsmb.sys 12:28:12.0942 3736 mrxsmb - ok 12:28:13.0020 3736 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\windows\system32\DRIVERS\mrxsmb10.sys 12:28:13.0067 3736 mrxsmb10 - ok 12:28:13.0098 3736 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\windows\system32\DRIVERS\mrxsmb20.sys 12:28:13.0129 3736 mrxsmb20 - ok 12:28:13.0161 3736 msahci (5c37497276e3b3a5488b23a326a754b7) C:\windows\system32\DRIVERS\msahci.sys 12:28:13.0192 3736 msahci - ok 12:28:13.0223 3736 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\windows\system32\DRIVERS\msdsm.sys 12:28:13.0270 3736 msdsm - ok 12:28:13.0317 3736 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\windows\System32\msdtc.exe 12:28:13.0363 3736 MSDTC - ok 12:28:13.0426 3736 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys 12:28:13.0519 3736 Msfs - ok 12:28:13.0535 3736 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys 12:28:13.0582 3736 mshidkmdf - ok 12:28:13.0597 3736 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\DRIVERS\msisadrv.sys 12:28:13.0613 3736 msisadrv - ok 12:28:13.0660 3736 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\windows\system32\iscsiexe.dll 12:28:13.0738 3736 MSiSCSI - ok 12:28:13.0738 3736 msiserver - ok 12:28:13.0769 3736 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys 12:28:13.0831 3736 MSKSSRV - ok 12:28:13.0863 3736 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys 12:28:13.0909 3736 MSPCLOCK - ok 12:28:13.0925 3736 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys 12:28:14.0003 3736 MSPQM - ok 12:28:14.0050 3736 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\windows\system32\drivers\MsRPC.sys 12:28:14.0065 3736 MsRPC - ok 12:28:14.0097 3736 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys 12:28:14.0097 3736 mssmbios - ok 12:28:14.0128 3736 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys 12:28:14.0175 3736 MSTEE - ok 12:28:14.0190 3736 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\DRIVERS\MTConfig.sys 12:28:14.0221 3736 MTConfig - ok 12:28:14.0237 3736 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys 12:28:14.0253 3736 Mup - ok 12:28:14.0299 3736 napagent (4987e079a4530fa737a128be54b63b12) C:\windows\system32\qagentRT.dll 12:28:14.0377 3736 napagent - ok 12:28:14.0440 3736 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys 12:28:14.0502 3736 NativeWifiP - ok 12:28:14.0611 3736 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\windows\system32\drivers\ndis.sys 12:28:14.0658 3736 NDIS - ok 12:28:14.0689 3736 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys 12:28:14.0752 3736 NdisCap - ok 12:28:14.0767 3736 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys 12:28:14.0814 3736 NdisTapi - ok 12:28:14.0845 3736 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\windows\system32\DRIVERS\ndisuio.sys 12:28:14.0908 3736 Ndisuio - ok 12:28:14.0955 3736 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\windows\system32\DRIVERS\ndiswan.sys 12:28:14.0986 3736 NdisWan - ok 12:28:15.0033 3736 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\windows\system32\drivers\NDProxy.sys 12:28:15.0111 3736 NDProxy - ok 12:28:15.0157 3736 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys 12:28:15.0220 3736 NetBIOS - ok 12:28:15.0282 3736 NetBT (9162b273a44ab9dce5b44362731d062a) C:\windows\system32\DRIVERS\netbt.sys 12:28:15.0360 3736 NetBT - ok 12:28:15.0391 3736 Netlogon (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe 12:28:15.0407 3736 Netlogon - ok 12:28:15.0469 3736 Netman (847d3ae376c0817161a14a82c8922a9e) C:\windows\System32\netman.dll 12:28:15.0547 3736 Netman - ok 12:28:15.0594 3736 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\windows\System32\netprofm.dll 12:28:15.0657 3736 netprofm - ok 12:28:15.0735 3736 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 12:28:15.0766 3736 NetTcpPortSharing - ok 12:28:16.0249 3736 NETw5s64 (39ede676d17f37af4573c2b33ec28aca) C:\windows\system32\DRIVERS\NETw5s64.sys 12:28:16.0546 3736 NETw5s64 - ok 12:28:16.0717 3736 nfrd960 (77889813be4d166cdab78ddba990da92) C:\windows\system32\DRIVERS\nfrd960.sys 12:28:16.0749 3736 nfrd960 - ok 12:28:16.0795 3736 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\windows\System32\nlasvc.dll 12:28:16.0889 3736 NlaSvc - ok 12:28:16.0920 3736 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys 12:28:16.0967 3736 Npfs - ok 12:28:16.0983 3736 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\windows\system32\nsisvc.dll 12:28:17.0045 3736 nsi - ok 12:28:17.0061 3736 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys 12:28:17.0123 3736 nsiproxy - ok 12:28:17.0295 3736 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\windows\system32\drivers\Ntfs.sys 12:28:17.0373 3736 Ntfs - ok 12:28:17.0497 3736 Null (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys 12:28:17.0575 3736 Null - ok 12:28:18.0246 3736 nvlddmkm (56743d7b668a19bd83bcdfb1f2136738) C:\windows\system32\DRIVERS\nvlddmkm.sys 12:28:18.0621 3736 nvlddmkm - ok 12:28:18.0792 3736 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\windows\system32\drivers\nvraid.sys 12:28:18.0823 3736 nvraid - ok 12:28:18.0855 3736 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\windows\system32\drivers\nvstor.sys 12:28:18.0886 3736 nvstor - ok 12:28:18.0964 3736 nvsvc (1d462154c746161683ebb7d95d0c0af1) C:\windows\system32\nvvsvc.exe 12:28:18.0995 3736 nvsvc - ok 12:28:19.0213 3736 nvUpdatusService (18f1906bfe993ead51200e3195b3d6e2) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe 12:28:19.0291 3736 nvUpdatusService - ok 12:28:19.0447 3736 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\DRIVERS\nv_agp.sys 12:28:19.0479 3736 nv_agp - ok 12:28:19.0494 3736 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\DRIVERS\ohci1394.sys 12:28:19.0525 3736 ohci1394 - ok 12:28:19.0588 3736 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\windows\system32\pnrpsvc.dll 12:28:19.0650 3736 p2pimsvc - ok 12:28:19.0713 3736 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\windows\system32\p2psvc.dll 12:28:19.0759 3736 p2psvc - ok 12:28:19.0791 3736 Parport (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\DRIVERS\parport.sys 12:28:19.0822 3736 Parport - ok 12:28:19.0900 3736 partmgr (90061b1acfe8ccaa5345750ffe08d8b8) C:\windows\system32\drivers\partmgr.sys 12:28:19.0931 3736 partmgr - ok 12:28:19.0962 3736 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\windows\System32\pcasvc.dll 12:28:20.0009 3736 PcaSvc - ok 12:28:20.0040 3736 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\windows\system32\DRIVERS\pci.sys 12:28:20.0056 3736 pci - ok 12:28:20.0087 3736 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\DRIVERS\pciide.sys 12:28:20.0103 3736 pciide - ok 12:28:20.0134 3736 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\DRIVERS\pcmcia.sys 12:28:20.0149 3736 pcmcia - ok 12:28:20.0181 3736 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys 12:28:20.0181 3736 pcw - ok 12:28:20.0274 3736 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys 12:28:20.0352 3736 PEAUTH - ok 12:28:20.0446 3736 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\windows\SysWow64\perfhost.exe 12:28:20.0493 3736 PerfHost - ok 12:28:20.0633 3736 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\windows\system32\pla.dll 12:28:20.0773 3736 pla - ok 12:28:20.0836 3736 PlugPlay (98b1721b8718164293b9701b98c52d77) C:\windows\system32\umpnpmgr.dll 12:28:20.0914 3736 PlugPlay - ok 12:28:20.0945 3736 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\windows\system32\pnrpauto.dll 12:28:20.0976 3736 PNRPAutoReg - ok 12:28:21.0007 3736 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\windows\system32\pnrpsvc.dll 12:28:21.0023 3736 PNRPsvc - ok 12:28:21.0085 3736 Point64 (33328fa8a580885ab0065be6db266e9f) C:\windows\system32\DRIVERS\point64.sys 12:28:21.0101 3736 Point64 - ok 12:28:21.0179 3736 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\windows\System32\ipsecsvc.dll 12:28:21.0257 3736 PolicyAgent - ok 12:28:21.0304 3736 Power (6ba9d927dded70bd1a9caded45f8b184) C:\windows\system32\umpo.dll 12:28:21.0366 3736 Power - ok 12:28:21.0413 3736 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\windows\system32\DRIVERS\raspptp.sys 12:28:21.0475 3736 PptpMiniport - ok 12:28:21.0491 3736 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\DRIVERS\processr.sys 12:28:21.0522 3736 Processor - ok 12:28:21.0616 3736 ProfSvc (97293447431311c06703368ad0f6c4be) C:\windows\system32\profsvc.dll 12:28:21.0663 3736 ProfSvc - ok 12:28:21.0694 3736 ProtectedStorage (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe 12:28:21.0709 3736 ProtectedStorage - ok 12:28:21.0756 3736 Psched (ee992183bd8eaefd9973f352e587a299) C:\windows\system32\DRIVERS\pacer.sys 12:28:21.0819 3736 Psched - ok 12:28:21.0897 3736 PSI (fb46e9a827a8799ebd7bfa9128c91f37) C:\windows\system32\DRIVERS\psi_mf.sys 12:28:21.0912 3736 PSI - ok 12:28:22.0053 3736 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\DRIVERS\ql2300.sys 12:28:22.0131 3736 ql2300 - ok 12:28:22.0287 3736 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\DRIVERS\ql40xx.sys 12:28:22.0318 3736 ql40xx - ok 12:28:22.0380 3736 QWAVE (906191634e99aea92c4816150bda3732) C:\windows\system32\qwave.dll 12:28:22.0427 3736 QWAVE - ok 12:28:22.0458 3736 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys 12:28:22.0505 3736 QWAVEdrv - ok 12:28:22.0521 3736 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys 12:28:22.0599 3736 RasAcd - ok 12:28:22.0661 3736 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys 12:28:22.0723 3736 RasAgileVpn - ok 12:28:22.0755 3736 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\windows\System32\rasauto.dll 12:28:22.0848 3736 RasAuto - ok 12:28:22.0879 3736 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\windows\system32\DRIVERS\rasl2tp.sys 12:28:22.0957 3736 Rasl2tp - ok 12:28:23.0004 3736 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\windows\System32\rasmans.dll 12:28:23.0098 3736 RasMan - ok 12:28:23.0129 3736 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys 12:28:23.0191 3736 RasPppoe - ok 12:28:23.0223 3736 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys 12:28:23.0269 3736 RasSstp - ok 12:28:23.0332 3736 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\windows\system32\DRIVERS\rdbss.sys 12:28:23.0425 3736 rdbss - ok 12:28:23.0441 3736 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\DRIVERS\rdpbus.sys 12:28:23.0472 3736 rdpbus - ok 12:28:23.0503 3736 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys 12:28:23.0550 3736 RDPCDD - ok 12:28:23.0566 3736 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys 12:28:23.0613 3736 RDPENCDD - ok 12:28:23.0628 3736 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys 12:28:23.0675 3736 RDPREFMP - ok 12:28:23.0769 3736 RDPWD (447de7e3dea39d422c1504f245b668b1) C:\windows\system32\drivers\RDPWD.sys 12:28:23.0862 3736 RDPWD - ok 12:28:23.0909 3736 rdyboost (634b9a2181d98f15941236886164ec8b) C:\windows\system32\drivers\rdyboost.sys 12:28:23.0940 3736 rdyboost - ok 12:28:23.0971 3736 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\windows\System32\mprdim.dll 12:28:24.0018 3736 RemoteAccess - ok 12:28:24.0065 3736 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\windows\system32\regsvc.dll 12:28:24.0143 3736 RemoteRegistry - ok 12:28:24.0174 3736 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\windows\System32\RpcEpMap.dll 12:28:24.0221 3736 RpcEptMapper - ok 12:28:24.0252 3736 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\windows\system32\locator.exe 12:28:24.0268 3736 RpcLocator - ok 12:28:24.0315 3736 RpcSs (7266972e86890e2b30c0c322e906b027) C:\windows\system32\rpcss.dll 12:28:24.0361 3736 RpcSs - ok 12:28:24.0408 3736 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys 12:28:24.0455 3736 rspndr - ok 12:28:24.0502 3736 RTL8167 (7ea8d2eb9bbfd2ab8a3117a1e96d3b3a) C:\windows\system32\DRIVERS\Rt64win7.sys 12:28:24.0533 3736 RTL8167 - ok 12:28:24.0564 3736 SamSs (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe 12:28:24.0580 3736 SamSs - ok 12:28:24.0611 3736 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\windows\system32\DRIVERS\sbp2port.sys 12:28:24.0627 3736 sbp2port - ok 12:28:24.0689 3736 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\windows\System32\SCardSvr.dll 12:28:24.0798 3736 SCardSvr - ok 12:28:24.0814 3736 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\windows\system32\DRIVERS\scfilter.sys 12:28:24.0861 3736 scfilter - ok 12:28:24.0970 3736 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\windows\system32\schedsvc.dll 12:28:25.0017 3736 Schedule - ok 12:28:25.0048 3736 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\windows\System32\certprop.dll 12:28:25.0095 3736 SCPolicySvc - ok 12:28:25.0141 3736 sdbus (54e47ad086782d3ae9417c155cdceb9b) C:\windows\system32\DRIVERS\sdbus.sys 12:28:25.0173 3736 sdbus - ok 12:28:25.0219 3736 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\windows\System32\SDRSVC.dll 12:28:25.0282 3736 SDRSVC - ok 12:28:25.0375 3736 SeaPort (d358e077a0a05d9b12da22d137ee8464) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 12:28:25.0391 3736 SeaPort - ok 12:28:25.0422 3736 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys 12:28:25.0500 3736 secdrv - ok 12:28:25.0531 3736 seclogon (463b386ebc70f98da5dff85f7e654346) C:\windows\system32\seclogon.dll 12:28:25.0594 3736 seclogon - ok 12:28:25.0859 3736 Secunia PSI Agent (f70a51eb03ee7046784ef62efce9528e) C:\Program Files (x86)\Secunia\PSI\PSIA.exe 12:28:25.0984 3736 Secunia PSI Agent - ok 12:28:26.0155 3736 Secunia Update Agent (ad56ceb08eeb517332355fde9e5939c8) C:\Program Files (x86)\Secunia\PSI\sua.exe 12:28:26.0202 3736 Secunia Update Agent - ok 12:28:26.0327 3736 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\windows\System32\sens.dll 12:28:26.0405 3736 SENS - ok 12:28:26.0421 3736 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\windows\system32\sensrsvc.dll 12:28:26.0467 3736 SensrSvc - ok 12:28:26.0514 3736 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\DRIVERS\serenum.sys 12:28:26.0545 3736 Serenum - ok 12:28:26.0561 3736 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\DRIVERS\serial.sys 12:28:26.0608 3736 Serial - ok 12:28:26.0608 3736 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\DRIVERS\sermouse.sys 12:28:26.0623 3736 sermouse - ok 12:28:26.0670 3736 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\windows\system32\sessenv.dll 12:28:26.0717 3736 SessionEnv - ok 12:28:26.0717 3736 sffdisk (a554811bcd09279536440c964ae35bbf) C:\windows\system32\DRIVERS\sffdisk.sys 12:28:26.0748 3736 sffdisk - ok 12:28:26.0764 3736 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\DRIVERS\sffp_mmc.sys 12:28:26.0779 3736 sffp_mmc - ok 12:28:26.0779 3736 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\windows\system32\DRIVERS\sffp_sd.sys 12:28:26.0811 3736 sffp_sd - ok 12:28:26.0826 3736 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\DRIVERS\sfloppy.sys 12:28:26.0842 3736 sfloppy - ok 12:28:26.0889 3736 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\windows\System32\ipnathlp.dll 12:28:26.0967 3736 SharedAccess - ok 12:28:27.0045 3736 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\windows\System32\shsvcs.dll 12:28:27.0091 3736 ShellHWDetection - ok 12:28:27.0107 3736 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\DRIVERS\SiSRaid2.sys 12:28:27.0123 3736 SiSRaid2 - ok 12:28:27.0185 3736 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\DRIVERS\sisraid4.sys 12:28:27.0201 3736 SiSRaid4 - ok 12:28:27.0310 3736 SkypeUpdate (ea396139541706b4b433641d62ea53ce) C:\Program Files (x86)\Skype\Updater\Updater.exe 12:28:27.0325 3736 SkypeUpdate - ok 12:28:27.0341 3736 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys 12:28:27.0403 3736 Smb - ok 12:28:27.0528 3736 smserial (7ae8bca90539ecbde87ac45ba1436be3) C:\windows\system32\DRIVERS\SmSerl64.sys 12:28:27.0606 3736 smserial - ok 12:28:27.0637 3736 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\windows\System32\snmptrap.exe 12:28:27.0669 3736 SNMPTRAP - ok 12:28:27.0684 3736 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys 12:28:27.0700 3736 spldr - ok 12:28:27.0762 3736 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\windows\System32\spoolsv.exe 12:28:27.0825 3736 Spooler - ok 12:28:28.0074 3736 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\windows\system32\sppsvc.exe 12:28:28.0183 3736 sppsvc - ok 12:28:28.0308 3736 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\windows\system32\sppuinotify.dll 12:28:28.0371 3736 sppuinotify - ok 12:28:28.0495 3736 sptd (602884696850c86434530790b110e8eb) C:\windows\system32\Drivers\sptd.sys 12:28:28.0495 3736 Suspicious file (NoAccess): C:\windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb 12:28:28.0511 3736 sptd ( LockedFile.Multi.Generic ) - warning 12:28:28.0511 3736 sptd - detected LockedFile.Multi.Generic (1) 12:28:28.0589 3736 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\windows\system32\DRIVERS\srv.sys 12:28:28.0667 3736 srv - ok 12:28:28.0729 3736 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\windows\system32\DRIVERS\srv2.sys 12:28:28.0761 3736 srv2 - ok 12:28:28.0807 3736 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\windows\system32\DRIVERS\srvnet.sys 12:28:28.0839 3736 srvnet - ok 12:28:28.0901 3736 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\windows\System32\ssdpsrv.dll 12:28:28.0995 3736 SSDPSRV - ok 12:28:29.0041 3736 SSPORT (0211ab46b73a2623b86c1cfcb30579ab) C:\windows\system32\Drivers\SSPORT.sys 12:28:29.0057 3736 SSPORT - ok 12:28:29.0119 3736 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\windows\system32\sstpsvc.dll 12:28:29.0166 3736 SstpSvc - ok 12:28:29.0213 3736 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\DRIVERS\stexstor.sys 12:28:29.0213 3736 stexstor - ok 12:28:29.0291 3736 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\windows\System32\wiaservc.dll 12:28:29.0369 3736 stisvc - ok 12:28:29.0385 3736 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys 12:28:29.0400 3736 swenum - ok 12:28:29.0447 3736 swprv (e08e46fdd841b7184194011ca1955a0b) C:\windows\System32\swprv.dll 12:28:29.0541 3736 swprv - ok 12:28:29.0712 3736 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\windows\system32\sysmain.dll 12:28:29.0790 3736 SysMain - ok 12:28:29.0915 3736 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\windows\System32\TabSvc.dll 12:28:29.0977 3736 TabletInputService - ok 12:28:30.0009 3736 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\windows\System32\tapisrv.dll 12:28:30.0071 3736 TapiSrv - ok 12:28:30.0087 3736 TBS (1be03ac720f4d302ea01d40f588162f6) C:\windows\System32\tbssvc.dll 12:28:30.0133 3736 TBS - ok 12:28:30.0367 3736 Tcpip (624c5b3aa4c99b3184bb922d9ece3ff0) C:\windows\system32\drivers\tcpip.sys 12:28:30.0445 3736 Tcpip - ok 12:28:30.0757 3736 TCPIP6 (624c5b3aa4c99b3184bb922d9ece3ff0) C:\windows\system32\DRIVERS\tcpip.sys 12:28:30.0804 3736 TCPIP6 - ok 12:28:30.0960 3736 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\windows\system32\drivers\tcpipreg.sys 12:28:31.0007 3736 tcpipreg - ok 12:28:31.0023 3736 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys 12:28:31.0085 3736 TDPIPE - ok 12:28:31.0116 3736 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\windows\system32\drivers\tdtcp.sys 12:28:31.0179 3736 TDTCP - ok 12:28:31.0225 3736 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\windows\system32\DRIVERS\tdx.sys 12:28:31.0303 3736 tdx - ok 12:28:31.0553 3736 TeamViewer6 (1c46c27e9f1938b9589859c70450d275) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe 12:28:31.0600 3736 TeamViewer6 - ok 12:28:31.0740 3736 teamviewervpn (f5520dbb47c60ee83024b38720abda24) C:\windows\system32\DRIVERS\teamviewervpn.sys 12:28:31.0756 3736 teamviewervpn - ok 12:28:31.0803 3736 TermDD (c448651339196c0e869a355171875522) C:\windows\system32\DRIVERS\termdd.sys 12:28:31.0834 3736 TermDD - ok 12:28:31.0912 3736 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\windows\System32\termsrv.dll 12:28:31.0974 3736 TermService - ok 12:28:31.0990 3736 Themes (f0344071948d1a1fa732231785a0664c) C:\windows\system32\themeservice.dll 12:28:32.0021 3736 Themes - ok 12:28:32.0037 3736 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\windows\system32\mmcss.dll 12:28:32.0083 3736 THREADORDER - ok 12:28:32.0115 3736 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\windows\System32\trkwks.dll 12:28:32.0177 3736 TrkWks - ok 12:28:32.0255 3736 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\windows\servicing\TrustedInstaller.exe 12:28:32.0286 3736 TrustedInstaller - ok 12:28:32.0317 3736 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\windows\system32\DRIVERS\tssecsrv.sys 12:28:32.0380 3736 tssecsrv - ok 12:28:32.0427 3736 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\windows\system32\DRIVERS\tunnel.sys 12:28:32.0473 3736 tunnel - ok 12:28:32.0505 3736 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\DRIVERS\uagp35.sys 12:28:32.0505 3736 uagp35 - ok 12:28:32.0583 3736 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\windows\system32\DRIVERS\udfs.sys 12:28:32.0692 3736 udfs - ok 12:28:32.0754 3736 UDST7000BDA (8943b9448dbd57570e4919326b312ee8) C:\windows\system32\DRIVERS\UDST7000BDA.sys 12:28:32.0801 3736 UDST7000BDA - ok 12:28:32.0832 3736 UDST7000HID (d44cb4ea5cddcb0ccd535ffcd8975eba) C:\windows\system32\DRIVERS\UDST7000HID.sys 12:28:32.0832 3736 UDST7000HID - ok 12:28:32.0879 3736 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\windows\system32\UI0Detect.exe 12:28:32.0910 3736 UI0Detect - ok 12:28:32.0941 3736 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\DRIVERS\uliagpkx.sys 12:28:32.0957 3736 uliagpkx - ok 12:28:32.0973 3736 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\windows\system32\DRIVERS\umbus.sys 12:28:33.0019 3736 umbus - ok 12:28:33.0019 3736 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\DRIVERS\umpass.sys 12:28:33.0051 3736 UmPass - ok 12:28:33.0300 3736 UNS (765f2dd351ba064f657751d8d75e58c0) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe 12:28:33.0378 3736 UNS - ok 12:28:33.0519 3736 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\windows\System32\upnphost.dll 12:28:33.0597 3736 upnphost - ok 12:28:33.0690 3736 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\windows\system32\Drivers\usbaapl64.sys 12:28:33.0737 3736 USBAAPL64 - ok 12:28:33.0768 3736 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\windows\system32\DRIVERS\usbccgp.sys 12:28:33.0831 3736 usbccgp - ok 12:28:33.0893 3736 usbcir (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\DRIVERS\usbcir.sys 12:28:33.0924 3736 usbcir - ok 12:28:33.0955 3736 usbehci (92969ba5ac44e229c55a332864f79677) C:\windows\system32\drivers\usbehci.sys 12:28:33.0971 3736 usbehci - ok 12:28:34.0002 3736 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\windows\system32\DRIVERS\usbhub.sys 12:28:34.0065 3736 usbhub - ok 12:28:34.0111 3736 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\windows\system32\drivers\usbohci.sys 12:28:34.0158 3736 usbohci - ok 12:28:34.0205 3736 usbprint (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\DRIVERS\usbprint.sys 12:28:34.0252 3736 usbprint - ok 12:28:34.0314 3736 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\windows\system32\DRIVERS\usbscan.sys 12:28:34.0361 3736 usbscan - ok 12:28:34.0392 3736 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\windows\system32\DRIVERS\USBSTOR.SYS 12:28:34.0423 3736 USBSTOR - ok 12:28:34.0455 3736 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\windows\system32\drivers\usbuhci.sys 12:28:34.0486 3736 usbuhci - ok 12:28:34.0564 3736 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\windows\System32\Drivers\usbvideo.sys 12:28:34.0611 3736 usbvideo - ok 12:28:34.0657 3736 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\windows\System32\uxsms.dll 12:28:34.0720 3736 UxSms - ok 12:28:34.0767 3736 VaultSvc (156f6159457d0aa7e59b62681b56eb90) C:\windows\system32\lsass.exe 12:28:34.0782 3736 VaultSvc - ok 12:28:34.0829 3736 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\DRIVERS\vdrvroot.sys 12:28:34.0860 3736 vdrvroot - ok 12:28:34.0954 3736 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\windows\System32\vds.exe 12:28:35.0047 3736 vds - ok 12:28:35.0063 3736 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys 12:28:35.0079 3736 vga - ok 12:28:35.0110 3736 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys 12:28:35.0172 3736 VgaSave - ok 12:28:35.0188 3736 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\windows\system32\DRIVERS\vhdmp.sys 12:28:35.0203 3736 vhdmp - ok 12:28:35.0235 3736 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\DRIVERS\viaide.sys 12:28:35.0235 3736 viaide - ok 12:28:35.0266 3736 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\windows\system32\DRIVERS\volmgr.sys 12:28:35.0281 3736 volmgr - ok 12:28:35.0313 3736 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\windows\system32\drivers\volmgrx.sys 12:28:35.0344 3736 volmgrx - ok 12:28:35.0375 3736 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\windows\system32\DRIVERS\volsnap.sys 12:28:35.0406 3736 volsnap - ok 12:28:35.0437 3736 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\DRIVERS\vsmraid.sys 12:28:35.0453 3736 vsmraid - ok 12:28:35.0593 3736 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\windows\system32\vssvc.exe 12:28:35.0656 3736 VSS - ok 12:28:35.0781 3736 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys 12:28:35.0796 3736 vwifibus - ok 12:28:35.0827 3736 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys 12:28:35.0859 3736 vwififlt - ok 12:28:35.0921 3736 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\windows\system32\DRIVERS\vwifimp.sys 12:28:35.0952 3736 vwifimp - ok 12:28:35.0999 3736 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\windows\system32\w32time.dll 12:28:36.0077 3736 W32Time - ok 12:28:36.0108 3736 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\DRIVERS\wacompen.sys 12:28:36.0155 3736 WacomPen - ok 12:28:36.0202 3736 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys 12:28:36.0280 3736 WANARP - ok 12:28:36.0295 3736 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\windows\system32\DRIVERS\wanarp.sys 12:28:36.0342 3736 Wanarpv6 - ok 12:28:36.0498 3736 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\windows\system32\wbengine.exe 12:28:36.0623 3736 wbengine - ok 12:28:36.0764 3736 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\windows\System32\wbiosrvc.dll 12:28:36.0827 3736 WbioSrvc - ok 12:28:36.0920 3736 wcncsvc (dd1bae8ebfc653824d29ccf8c9054d68) C:\windows\System32\wcncsvc.dll 12:28:36.0983 3736 wcncsvc - ok 12:28:36.0998 3736 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\windows\System32\WcsPlugInService.dll 12:28:37.0045 3736 WcsPlugInService - ok 12:28:37.0092 3736 Wd (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\DRIVERS\wd.sys 12:28:37.0123 3736 Wd - ok 12:28:37.0186 3736 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys 12:28:37.0232 3736 Wdf01000 - ok 12:28:37.0279 3736 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\windows\system32\wdi.dll 12:28:37.0310 3736 WdiServiceHost - ok 12:28:37.0310 3736 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\windows\system32\wdi.dll 12:28:37.0342 3736 WdiSystemHost - ok 12:28:37.0404 3736 WebClient (733006127f235be7c35354ebee7b9a7b) C:\windows\System32\webclnt.dll 12:28:37.0482 3736 WebClient - ok 12:28:37.0544 3736 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\windows\system32\wecsvc.dll 12:28:37.0654 3736 Wecsvc - ok 12:28:37.0685 3736 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\windows\System32\wercplsupport.dll 12:28:37.0747 3736 wercplsupport - ok 12:28:37.0794 3736 WerSvc (6d137963730144698cbd10f202e9f251) C:\windows\System32\WerSvc.dll 12:28:37.0888 3736 WerSvc - ok 12:28:37.0950 3736 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys 12:28:38.0012 3736 WfpLwf - ok 12:28:38.0028 3736 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys 12:28:38.0044 3736 WIMMount - ok 12:28:38.0106 3736 WinDefend - ok 12:28:38.0122 3736 WinHttpAutoProxySvc - ok 12:28:38.0215 3736 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\windows\system32\wbem\WMIsvc.dll 12:28:38.0293 3736 Winmgmt - ok 12:28:38.0465 3736 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\windows\system32\WsmSvc.dll 12:28:38.0590 3736 WinRM - ok 12:28:38.0792 3736 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\windows\System32\wlansvc.dll 12:28:38.0839 3736 Wlansvc - ok 12:28:38.0886 3736 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys 12:28:38.0917 3736 WmiAcpi - ok 12:28:39.0011 3736 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\windows\system32\wbem\WmiApSrv.exe 12:28:39.0073 3736 wmiApSrv - ok 12:28:39.0136 3736 WMPNetworkSvc - ok 12:28:39.0167 3736 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\windows\System32\wpcsvc.dll 12:28:39.0214 3736 WPCSvc - ok 12:28:39.0260 3736 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\windows\system32\wpdbusenum.dll 12:28:39.0276 3736 WPDBusEnum - ok 12:28:39.0307 3736 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys 12:28:39.0370 3736 ws2ifsl - ok 12:28:39.0416 3736 wscsvc (8f9f3969933c02da96eb0f84576db43e) C:\windows\System32\wscsvc.dll 12:28:39.0463 3736 wscsvc - ok 12:28:39.0463 3736 WSearch - ok 12:28:39.0666 3736 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\windows\system32\wuaueng.dll 12:28:39.0760 3736 wuauserv - ok 12:28:39.0916 3736 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\windows\system32\drivers\WudfPf.sys 12:28:40.0025 3736 WudfPf - ok 12:28:40.0072 3736 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\windows\system32\DRIVERS\WUDFRd.sys 12:28:40.0134 3736 WUDFRd - ok 12:28:40.0181 3736 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\windows\System32\WUDFSvc.dll 12:28:40.0259 3736 wudfsvc - ok 12:28:40.0321 3736 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\windows\System32\wwansvc.dll 12:28:40.0368 3736 WwanSvc - ok 12:28:40.0446 3736 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 12:28:40.0898 3736 \Device\Harddisk0\DR0 - ok 12:28:40.0930 3736 Boot (0x1200) (1ad88f4aa9cc3c90775abc549902d820) \Device\Harddisk0\DR0\Partition0 12:28:40.0930 3736 \Device\Harddisk0\DR0\Partition0 - ok 12:28:40.0930 3736 ============================================================ 12:28:40.0930 3736 Scan finished 12:28:40.0930 3736 ============================================================ 12:28:40.0945 2336 Detected object count: 3 12:28:40.0945 2336 Actual detected object count: 3 12:34:25.0098 2336 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user 12:34:25.0098 2336 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip 12:34:25.0098 2336 Micro Star SCM ( UnsignedFile.Multi.Generic ) - skipped by user 12:34:25.0098 2336 Micro Star SCM ( UnsignedFile.Multi.Generic ) - User select action: Skip 12:34:25.0098 2336 sptd ( LockedFile.Multi.Generic ) - skipped by user 12:34:25.0098 2336 sptd ( LockedFile.Multi.Generic ) - User select action: Skip |
20.07.2012, 17:59 | #20 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | GVU-Trojaner Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
22.07.2012, 13:00 | #21 |
| GVU-Trojaner Okay...hier die Log-Datei von ComboFix: Code:
ATTFilter ComboFix 12-07-21.01 - Julia 22.07.2012 13:31:27.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3886.2197 [GMT 2:00] ausgeführt von:: c:\users\Julia\Desktop\ComboFix.exe AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Neuer Wiederherstellungspunkt wurde erstellt . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\windows\IsUn0407.exe . . ((((((((((((((((((((((( Dateien erstellt von 2012-06-22 bis 2012-07-22 )))))))))))))))))))))))))))))) . . 2012-07-20 09:25 . 2012-07-16 00:40 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0B485D3-EC5D-4CBC-BD1D-4D708BBCDBDA}\mpengine.dll 2012-07-15 10:21 . 2012-07-16 17:28 -------- d-----w- C:\_OTL 2012-07-11 18:06 . 2012-06-12 03:02 3147264 ----a-w- c:\windows\system32\win32k.sys 2012-07-11 16:47 . 2012-07-11 16:47 -------- d-----w- c:\program files (x86)\ESET 2012-07-10 18:03 . 2012-07-10 18:03 -------- d-----w- c:\program files (x86)\MozBackup 2012-07-06 18:54 . 2012-07-11 18:02 59701280 ----a-w- c:\windows\system32\MRT.exe 2012-07-06 18:47 . 2012-07-06 18:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2012-07-06 18:47 . 2012-07-06 18:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2012-07-06 18:47 . 2012-07-06 18:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2012-07-06 18:47 . 2012-07-06 18:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2012-07-06 18:47 . 2012-07-06 18:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2012-07-06 18:47 . 2012-07-06 18:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2012-07-06 18:47 . 2012-07-06 18:47 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2012-07-06 18:46 . 2012-07-06 18:47 -------- d-----w- c:\program files (x86)\QuickTime 2012-07-06 18:20 . 2012-07-06 18:20 -------- d-----w- c:\program files (x86)\Common Files\Skype 2012-07-06 18:20 . 2012-07-06 18:20 -------- d-----r- c:\program files (x86)\Skype 2012-07-06 17:59 . 2012-07-06 17:59 476936 ----a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-07-06 17:55 . 2012-07-06 17:55 -------- d-----w- c:\program files\iPod 2012-07-06 17:55 . 2012-07-06 17:57 -------- d-----w- c:\program files\iTunes 2012-07-06 17:52 . 2012-07-06 17:52 -------- d-----w- c:\program files (x86)\Apple Software Update 2012-07-06 17:44 . 2012-07-06 17:44 -------- d-----w- c:\users\Julia\AppData\Local\Secunia PSI 2012-07-06 17:44 . 2012-07-06 17:44 -------- d-----w- c:\program files (x86)\Secunia 2012-07-06 17:40 . 2012-07-06 17:40 -------- d-----w- c:\programdata\Panda Security 2012-07-06 17:40 . 2012-07-06 17:40 -------- d-----w- c:\program files (x86)\Panda USB Vaccine 2012-07-05 16:09 . 2012-07-05 16:09 -------- d-----w- c:\users\Julia\AppData\Roaming\TeamViewer 2012-07-05 15:55 . 2012-07-05 15:55 834544 ----a-w- c:\windows\system32\drivers\sptd.sys 2012-07-05 15:54 . 2012-07-05 15:54 -------- d-----w- c:\program files (x86)\LSoft Technologies 2012-07-05 14:21 . 2012-07-06 14:13 -------- d-----w- c:\users\Julia\AppData\Local\ElevatedDiagnostics 2012-07-05 14:00 . 2012-07-05 14:00 -------- d-----w- c:\users\Julia\AppData\Roaming\Malwarebytes 2012-07-05 14:00 . 2012-07-05 14:00 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-07-05 14:00 . 2012-07-05 14:00 -------- d-----w- c:\programdata\Malwarebytes 2012-07-05 14:00 . 2012-04-04 13:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-06-24 18:15 . 2012-06-24 18:15 -------- d-----w- c:\users\Julia\AppData\Local\Macromedia . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-12 09:50 . 2012-04-01 12:03 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-12 09:50 . 2011-07-02 10:31 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-06 17:59 . 2011-07-02 11:12 472840 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-07-05 23:23 . 2012-07-05 23:22 54120 ----a-w- C:\OTL.zip 2012-06-02 22:19 . 2012-06-21 11:31 38424 ----a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-21 11:32 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-21 11:32 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-21 11:32 44056 ----a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-21 11:31 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-21 11:32 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-21 11:31 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-06-02 13:19 . 2012-06-21 11:30 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-02 13:15 . 2012-06-21 11:30 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-05-31 10:25 . 2011-07-02 11:00 279656 ------w- c:\windows\system32\MpSigStub.exe 2012-05-15 03:56 . 2012-06-14 09:35 1197568 ----a-w- c:\windows\system32\wininet.dll 2012-05-15 03:52 . 2012-06-14 09:35 64512 ----a-w- c:\windows\system32\jsproxy.dll 2012-05-15 03:08 . 2012-06-14 09:35 981504 ----a-w- c:\windows\SysWow64\wininet.dll 2012-05-04 10:52 . 2012-06-14 09:35 5505392 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:08 . 2012-06-14 09:35 3958128 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:08 . 2012-06-14 09:35 3902320 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-05-02 05:32 . 2012-06-14 09:35 208896 ----a-w- c:\windows\system32\profsvc.dll 2012-04-28 03:50 . 2012-06-14 09:35 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 05:34 . 2012-06-14 09:35 76288 ----a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 05:34 . 2012-06-14 09:35 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 05:28 . 2012-06-14 09:35 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-24 05:59 . 2012-06-14 09:34 1460224 ----a-w- c:\windows\system32\crypt32.dll 2012-04-24 05:59 . 2012-06-14 09:34 182272 ----a-w- c:\windows\system32\cryptsvc.dll 2012-04-24 05:59 . 2012-06-14 09:34 140288 ----a-w- c:\windows\system32\cryptnet.dll 2012-04-24 04:47 . 2012-06-14 09:34 139264 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2012-04-24 04:47 . 2012-06-14 09:34 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2012-04-24 04:47 . 2012-06-14 09:34 1156608 ----a-w- c:\windows\SysWow64\crypt32.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072] "Remote Control Editor"="c:\program files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe" [2010-09-13 1695816] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696] "MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2010-06-05 2486272] "THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" [2010-05-16 1349632] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-6-27 572000] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056] R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [2009-12-05 87888] R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800] R3 MGHwCtrl;MGHwCtrl;c:\program files\msi\msi Software Install\MGHwCtrl.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-04-13 45432] R3 UDST7000BDA;TerraTec S7 service;c:\windows\system32\DRIVERS\UDST7000BDA.sys [2010-02-10 572608] R3 UDST7000HID;TerraTec H7/S7 HID service;c:\windows\system32\DRIVERS\UDST7000HID.sys [2010-02-10 25664] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-07-05 834544] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360] S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336] S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe [2009-07-09 160768] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2010-05-05 1604200] S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-06-27 1326176] S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-06-27 681056] S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-11-17 11576] S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656] S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-01-18 128512] S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-02 271872] S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-18 32344] S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-01-13 7675392] S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2011-12-16 17976] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-04 346144] S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2011-03-30 35112] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] . . --- Andere Dienste/Treiber im Speicher --- . *NewlyCreated* - WS2IFSL . Inhalt des "geplante Tasks" Ordners . 2012-07-22 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 09:50] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-26 413208] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 17412200] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-26 10816544] "THXCfg64"="c:\windows\system32\THXCfg64.dll" [2009-10-15 17920] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 "AppInit_DLLs"=c:\windows\System32\nvinitx.dll . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://msi.msn.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\zvhu1dy6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ . - - - - Entfernte verwaiste Registrierungseinträge - - - - . HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe AddRemove-Caesar 3 - c:\windows\IsUn0407.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Weitere laufende Prozesse ------------------------ . c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\AnVir Task Manager\AnVir.exe c:\program files (x86)\Panda USB Vaccine\USBVaccine.exe c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac . ************************************************************************** . Zeit der Fertigstellung: 2012-07-22 13:55:20 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2012-07-22 11:55 . Vor Suchlauf: 4.321.902.592 Bytes frei Nach Suchlauf: 2.851.790.848 Bytes frei . - - End Of File - - F456CAA00155195873B77827B913908E |
23.07.2012, 14:30 | #22 |
/// Winkelfunktion /// TB-Süch-Tiger™ | GVU-Trojaner Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes: Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.
__________________ Logfiles bitte immer in CODE-Tags posten |
25.07.2012, 18:26 | #23 |
| GVU-Trojaner So, die Logs sind erstellt, hier sind sie: 1. GMER Hierbei konnte ich allerdings nur Services, Registry und Files anhaken, die anderen Checkboxen waren alle disabled. Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net Rootkit scan 2012-07-25 18:05:25 Windows 6.1.7600 Running: poe2its1.exe ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792 ---- EOF - GMER 1.0.15 ---- Das "Autorun Data Scanning" ist direkt durchgelaufen. Das Online-Scannen der Files habe ich dann mit Cancel übersprungen, ich hoffe, das war so richtig. Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 18:12:05 on 25.07.2012 OS: Windows 7 Home Premium Edition (Build 7600), 64-bit Default Browser: Mozilla Corporation Firefox 14.0.1 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "nvcpl.cpl" - "NVIDIA Corporation" - C:\windows\system32\nvcpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgntflt" (avgntflt) - "Avira GmbH" - C:\windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\windows\System32\DRIVERS\avipbb.sys "catchme" (catchme) - ? - C:\ComboFix\catchme.sys (File not found) "DgiVecp" (DgiVecp) - ? - C:\windows\system32\Drivers\DgiVecp.sys (File not found) "MGHwCtrl" (MGHwCtrl) - ? - C:\Program Files\msi\msi Software Install\MGHwCtrl.sys (File not found) "PSI" (PSI) - "Secunia" - C:\windows\System32\DRIVERS\psi_mf.sys "sptd" (sptd) - "Duplex Secure Ltd." - C:\windows\System32\Drivers\sptd.sys (File is exclusively opened, access blocked) [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files (x86)\WinRAR\rarext.dll (File found, but it contains no detailed information) {B41DB860-64E4-11D2-9906-E49FADC173CA} "WinRAR shell extension" - ? - (File not found | COM-object registry key not found) {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_33.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "ICQ7.5" - "ICQ, LLC." - C:\Program Files (x86)\ICQ7.5\ICQ.exe {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll {AD6E6555-FB2C-47D4-8339-3E2965509877} "TerraTec Home Cinema" - "TerraTec Electronic GmbH" - C:\PROGRA~2\TerraTec\TERRAT~1\THCDES~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\ssv.dll {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corp." - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "Secunia PSI Tray.lnk" - "Secunia" - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "Remote Control Editor" - "Elgato Systems" - "C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe" -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" "ArcSoft Connection Service" - "ArcSoft Inc." - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe "avgnt" - "Avira GmbH" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min "IAStorIcon" - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe "iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe" "MGSysCtrl" - ? - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe "QuickTime Task" - "Apple Inc." - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" "THX Audio Control Panel" - "Creative Technology Ltd" - "C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" /r "UpdReg" - "Creative Technology Ltd." - C:\windows\UpdReg.EXE [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "ssb3m Langmon" - ? - C:\windows\system32\ssb3ml6.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll (File not found) "@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe" (File not found) "Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe "Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe "Google Updater Service" (gusvc) - "Google" - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe "Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe "Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe "Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Micro Star SCM" (Micro Star SCM) - "Micro-Star International Co., Ltd." - C:\Program Files (x86)\System Control Manager\MSIService.exe "Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\windows\system32\nvvsvc.exe "NVIDIA Update Service Daemon" (nvUpdatusService) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe "SeaPort" (SeaPort) - "Microsoft Corp." - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe "Secunia PSI Agent" (Secunia PSI Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\PSIA.exe "Secunia Update Agent" (Secunia Update Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\sua.exe "Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe "TeamViewer 6" (TeamViewer6) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru Code:
ATTFilter aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software Run date: 2012-07-25 18:48:10 ----------------------------- 18:48:10.255 OS Version: Windows x64 6.1.7600 18:48:10.255 Number of processors: 4 586 0x2502 18:48:10.255 ComputerName: JULIA UserName: Julia 18:48:12.173 Initialize success 18:48:17.337 AVAST engine defs: 12072500 18:48:52.063 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 18:48:52.063 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3 18:48:52.109 Disk 0 MBR read successfully 18:48:52.109 Disk 0 MBR scan 18:48:52.125 Disk 0 Windows 7 default MBR code 18:48:52.125 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12288 MB offset 2048 18:48:52.172 Disk 0 Partition 2 80 (A) 27 Hidden NTFS WinRE NTFS 100 MB offset 25167872 18:48:52.203 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 292854 MB offset 25372672 18:48:52.219 Disk 0 scanning C:\windows\system32\drivers 18:49:17.210 Service scanning 18:49:54.338 Modules scanning 18:49:54.354 Disk 0 trace - called modules: 18:49:54.400 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys spif.sys hal.dll 18:49:54.447 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004ca2060] 18:49:54.463 3 CLASSPNP.SYS[fffff88000d8543f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004986050] 18:49:57.552 AVAST engine scan C:\windows 18:50:08.050 AVAST engine scan C:\windows\system32 18:53:36.488 AVAST engine scan C:\windows\system32\drivers 18:53:47.861 AVAST engine scan C:\Users\Julia 19:08:56.030 AVAST engine scan C:\ProgramData 19:09:38.431 Scan finished successfully 19:11:00.003 Disk 0 MBR has been saved successfully to "C:\Users\Julia\Desktop\Virenscanner\MBR.dat" 19:11:00.003 The log file has been saved successfully to "C:\Users\Julia\Desktop\Virenscanner\aswMBR.txt" Gruß Hartmut |
26.07.2012, 12:08 | #24 |
/// Winkelfunktion /// TB-Süch-Tiger™ | GVU-Trojaner Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
27.07.2012, 05:51 | #25 |
| GVU-Trojaner Geschafft, hier die Ergebnisse: 1. Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.07.26.12 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Julia :: JULIA [Administrator] 26.07.2012 17:05:41 mbam-log-2012-07-26 (17-05-41).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 374294 Laufzeit: 52 Minute(n), 18 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 07/26/2012 at 11:00 PM Application Version : 5.5.1012 Core Rules Database Version : 8967 Trace Rules Database Version: 6779 Scan type : Complete Scan Total Scan Time : 02:32:27 Operating System Information Windows 7 Home Premium 64-bit (Build 6.01.7600) UAC On - Administrator Memory items scanned : 639 Memory threats detected : 0 Registry items scanned : 71477 Registry threats detected : 0 File items scanned : 152067 File threats detected : 108 Adware.Tracking Cookie C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@adx.chip[1].txt [ /adx.chip ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\julia@eyewonder[2].txt [ /eyewonder ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\BJVQ1ALS.txt [ /apmebf.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\4VB4AJ3H.txt [ /ad2.adfarm1.adition.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\MHAYLBW6.txt [ /mediaplex.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\C092XH3U.txt [ /zanox.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\LN9F9LHN.txt [ /smartadserver.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\Z9X4SPK7.txt [ /imrworldwide.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\P5XKJP5F.txt [ /tradedoubler.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\HGPJGTBT.txt [ /serving-sys.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\26JDO414.txt [ /c.atdmt.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\4EPFJ03K.txt [ /adfarm1.adition.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\K0SM47KQ.txt [ /track.adform.net ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\EVU1WOXA.txt [ /adform.net ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\X0FL16IW.txt [ /questionmarket.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\VBZA7MVC.txt [ /eas.apm.emediate.eu ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\AF02R85P.txt [ /bs.serving-sys.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\7DW2W5MW.txt [ /tracking.quisma.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\NYFG6RB8.txt [ /invitemedia.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\GUFTT0B9.txt [ /ad.yieldmanager.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\46VWVF1Z.txt [ /doubleclick.net ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\7EB48F0T.txt [ /fastclick.net ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\REMIDE9D.txt [ /ad3.adfarm1.adition.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\GMVMU0Z9.txt [ /content.yieldmanager.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\N6IOQ992.txt [ /ad1.adfarm1.adition.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\TI0FKZBJ.txt [ /atdmt.com ] C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Cookies\HMVXCDSD.txt [ /ad.zanox.com ] C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\julia@statse.webtrendslive[2].txt [ Cookie:julia@statse.webtrendslive.com/ ] C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\SMLA53DU.txt [ Cookie:julia@imrworldwide.com/cgi-bin ] C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\3NHQY4XD.txt [ Cookie:julia@c.atdmt.com/ ] C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\LU4K8QOM.txt [ Cookie:julia@doubleclick.net/ ] C:\USERS\JULIA\AppData\Roaming\Microsoft\Windows\Cookies\Low\YBLWI10J.txt [ Cookie:julia@atdmt.com/ ] C:\USERS\JULIA\Cookies\julia@adx.chip[1].txt [ Cookie:julia@adx.chip.de/ ] C:\USERS\JULIA\Cookies\BJVQ1ALS.txt [ Cookie:julia@apmebf.com/ ] C:\USERS\JULIA\Cookies\4VB4AJ3H.txt [ Cookie:julia@ad2.adfarm1.adition.com/ ] C:\USERS\JULIA\Cookies\MHAYLBW6.txt [ Cookie:julia@mediaplex.com/ ] C:\USERS\JULIA\Cookies\C092XH3U.txt [ Cookie:julia@zanox.com/ ] C:\USERS\JULIA\Cookies\LN9F9LHN.txt [ Cookie:julia@smartadserver.com/ ] C:\USERS\JULIA\Cookies\Z9X4SPK7.txt [ Cookie:julia@imrworldwide.com/cgi-bin ] C:\USERS\JULIA\Cookies\P5XKJP5F.txt [ Cookie:julia@tradedoubler.com/ ] C:\USERS\JULIA\Cookies\HGPJGTBT.txt [ Cookie:julia@serving-sys.com/ ] C:\USERS\JULIA\Cookies\26JDO414.txt [ Cookie:julia@c.atdmt.com/ ] C:\USERS\JULIA\Cookies\K0SM47KQ.txt [ Cookie:julia@track.adform.net/ ] C:\USERS\JULIA\Cookies\EVU1WOXA.txt [ Cookie:julia@adform.net/ ] C:\USERS\JULIA\Cookies\X0FL16IW.txt [ Cookie:julia@questionmarket.com/ ] C:\USERS\JULIA\Cookies\AF02R85P.txt [ Cookie:julia@bs.serving-sys.com/ ] C:\USERS\JULIA\Cookies\7DW2W5MW.txt [ Cookie:julia@tracking.quisma.com/ ] C:\USERS\JULIA\Cookies\NYFG6RB8.txt [ Cookie:julia@invitemedia.com/ ] C:\USERS\JULIA\Cookies\46VWVF1Z.txt [ Cookie:julia@doubleclick.net/ ] C:\USERS\JULIA\Cookies\REMIDE9D.txt [ Cookie:julia@ad3.adfarm1.adition.com/ ] C:\USERS\JULIA\Cookies\GMVMU0Z9.txt [ Cookie:julia@content.yieldmanager.com/ ] C:\USERS\JULIA\Cookies\N6IOQ992.txt [ Cookie:julia@ad1.adfarm1.adition.com/ ] C:\USERS\JULIA\Cookies\TI0FKZBJ.txt [ Cookie:julia@atdmt.com/ ] C:\USERS\JULIA\Cookies\HMVXCDSD.txt [ Cookie:julia@ad.zanox.com/ ] stat.ed.cupidplc.com [ C:\USERS\JULIA\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\KMX3DZP6 ] .doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] ad.zanox.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] 7.rotator.wigetmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] 7.rotator.wigetmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] 7.rotator.wigetmedia.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .atdmt.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .webmasterplan.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .tradedoubler.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .traffictrack.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .apmebf.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] track.adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] track.adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .adform.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .unitymedia.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .unitymedia.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .doubleclick.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .serving-sys.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .ad.adnet.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] ad4.adfarm1.adition.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .revsci.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .mediaplex.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] ww251.smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .xiti.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .smartadserver.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .statcounter.com [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] .2o7.net [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] www.etracker.de [ C:\USERS\JULIA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZVHU1DY6.DEFAULT\COOKIES.SQLITE ] Hartmut |
27.07.2012, 11:29 | #26 |
/// Winkelfunktion /// TB-Süch-Tiger™ | GVU-Trojaner Sieht ok aus, da wurden nur Cookies gefunden. Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/ Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
27.07.2012, 13:15 | #27 |
| GVU-Trojaner Mein System scheint in Ordnung zu sein, zumindest bemerke ich keine Probleme. Das einzige ist, dass der Rechner mir langsamer vorkommt als vorher. Ich werde mich dann erst mal daran machen, die ganzen Scanner, die ich installiert habe, wieder zu deinstallieren. Mal sehen, wie der sich dann verhält. Mit deinen Tipps zu den Cookies werd ich mich nun auch mal auseinandersetzen. Vielen Dank erst mal für die gute Unterstützung! Gruß Hartmut |
27.07.2012, 14:13 | #28 |
/// Winkelfunktion /// TB-Süch-Tiger™ | GVU-Trojaner Dann wären wir durch! Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen: Starte bitte OTL und klicke auf Bereinigung. Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen. Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken. Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers: Prüfen => Adobe - Flash Player Downloadlinks => Adobe Flash Player Distribution | Adobe Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
09.08.2012, 15:39 | #29 |
| GVU-Trojaner Hallo, ich melde mich zurück mit der Feststellung: Alles erledigt! Hat ein bisschen gedauert wegen der Urlaubszeit. Vielen Dank noch einmal für die gute Unterstützung! Gruß Hartmut |
Themen zu GVU-Trojaner |
anhang, anleitung, aufgetaucht, befindet, benötigt, beseitigt, boot-cd, dateien, dringend, entfernen, erstell, erstellt, folge, folgender, gvu-trojaner, hallo zusammen, hilfe!, home, lieber, notebook, prüfung, system, versucht, windows, windows 7, zusammen |