| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner Generic29.AGEZ+Cryptic.EGJWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
| |
29.08.2012, 20:22
| #1 |
 |  Trojaner Generic29.AGEZ+Cryptic.EGJ Guten Tag liebes Forum, ich hoffe ihr könnt mir helfen. Ich wollte mir gerade etwas runterladen und es haben sich auf der Downloadseite 5 neue Tabs geöffnet, mehrmals, bis ich dann von der Seite runterging. Dann kam von AVG diese Meldung, dass irgendetwas geblockt wurde. Danach habe ich sofort ein Scan mit AVG gemacht und es wurde nix gefunden, poste aber mal zur Sicherheit hier etwas rein. Habe auf Ok geklickt. Dann nach ca 10 Minuten kam auf einmal die Meldung, dass ich mir ein 2 Trojaner gefangen habe: Code:
ATTFilter "Infektion";"Trojaner: Generic29.AGEZ";"c:\Users\Sascha\AppData\Local\Temp\rncxewsoam.exe";"Nicht verfügbar";"29.08.2012, 20:38:46"
Code:
ATTFilter "Infektion";"Trojaner: Cryptic.EGJ";"c:\Users\Sascha\AppData\Local\Temp\owsacxenrm.exe";"Nicht verfügbar";"29.08.2012, 20:38:48"
OTL und so habe ich alles drauf, hier das Log: Code:
ATTFilter OTL logfile created on: 29.08.2012 20:53:18 - Run 4 OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Sascha\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,79 Gb Available Physical Memory | 59,56% Memory free 6,00 Gb Paging File | 4,56 Gb Available in Paging File | 76,03% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 150,16 Gb Total Space | 119,67 Gb Free Space | 79,69% Space Free | Partition Type: NTFS Drive D: | 488,28 Gb Total Space | 388,91 Gb Free Space | 79,65% Space Free | Partition Type: NTFS Drive E: | 292,87 Gb Total Space | 292,77 Gb Free Space | 99,96% Space Free | Partition Type: NTFS Computer Name: SASCHA-PC | User Name: Sascha | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.24 18:42:26 | 000,529,744 | ---- | M] (Valve Corporation) -- C:\Programme\Common Files\Steam\SteamService.exe PRC - [2012.08.09 14:07:35 | 003,414,680 | ---- | M] (Electronic Arts) -- C:\Programme\Origin\Origin.exe PRC - [2012.08.04 13:11:41 | 001,353,080 | ---- | M] (Valve Corporation) -- D:\Spiele\Steam\Steam.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.07.17 15:49:04 | 000,935,008 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe PRC - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgidsagent.exe PRC - [2012.06.28 14:05:43 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\java.exe PRC - [2012.06.24 10:52:23 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Sascha\Desktop\OTL.exe PRC - [2012.06.13 03:48:26 | 000,758,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgrsx.exe PRC - [2012.06.13 03:48:24 | 001,255,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgnsx.exe PRC - [2012.05.04 19:29:40 | 000,035,216 | ---- | M] (Oracle Corporation) -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2launcher.exe PRC - [2012.04.05 05:12:34 | 002,587,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgtray.exe PRC - [2012.03.19 05:18:12 | 000,979,840 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgemcx.exe PRC - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgwdsvc.exe PRC - [2012.02.14 04:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2012\avgcsrvx.exe PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2010.08.26 03:57:32 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2010.08.26 03:57:04 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2009.11.06 14:41:06 | 002,080,768 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe PRC - [2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.07.14 03:17:29 | 000,673,048 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.07.14 03:14:38 | 001,173,504 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.07.14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe ========== Modules (No Company Name) ========== MOD - [2012.08.29 20:37:48 | 000,161,792 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll MOD - [2012.08.24 18:42:24 | 020,317,008 | ---- | M] () -- D:\Spiele\Steam\bin\libcef.dll MOD - [2012.08.24 18:42:22 | 000,902,480 | ---- | M] () -- D:\Spiele\Steam\bin\chromehtml.dll MOD - [2012.08.24 18:42:20 | 000,123,232 | ---- | M] () -- D:\Spiele\Steam\bin\avutil-51.dll MOD - [2012.08.24 18:42:18 | 000,190,816 | ---- | M] () -- D:\Spiele\Steam\bin\avformat-53.dll MOD - [2012.08.24 18:42:16 | 001,099,616 | ---- | M] () -- D:\Spiele\Steam\bin\avcodec-53.dll MOD - [2012.05.30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.05.30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2012.05.04 19:29:38 | 000,015,760 | ---- | M] () -- C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2native.dll MOD - [2009.11.06 14:41:06 | 002,080,768 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WG111v3.exe MOD - [2009.03.04 09:52:36 | 000,372,736 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\WlanDll.dll MOD - [2008.12.29 17:13:24 | 000,204,800 | ---- | M] () -- C:\Programme\NETGEAR\WG111v3\KJLog.dll ========== Win32 Services (SafeList) ========== SRV - [2012.08.24 18:42:26 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.08.16 13:37:18 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.20 15:47:04 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.17 15:49:04 | 000,935,008 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe -- (vToolbarUpdater11.2.0) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent) SRV - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2012\avgwdsvc.exe -- (avgwd) SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.08.26 03:57:04 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Sascha\AppData\Local\Temp\catchme.sys -- (catchme) DRV - [2012.04.19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX) DRV - [2012.03.19 05:17:28 | 000,301,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2012.02.23 14:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService) DRV - [2012.02.22 05:25:32 | 000,235,216 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2012.01.31 04:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86) DRV - [2011.12.23 13:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2011.12.23 13:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim) DRV - [2011.12.23 13:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsfilterx.sys -- (AVGIDSFilter) DRV - [2011.12.23 13:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver) DRV - [2011.11.10 18:32:00 | 000,095,304 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MijXfilt.sys -- (MotioninJoyXFilter) DRV - [2011.03.18 18:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan) DRV - [2010.08.26 05:36:28 | 006,380,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2010.08.26 03:20:36 | 000,221,696 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2009.11.18 18:09:52 | 000,376,832 | ---- | M] (NETGEAR Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wg111v3.sys -- (RTL8187B) DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD) DRV - [2009.06.10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 90 DF 45 05 B3 4F CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\itunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012.07.17 15:58:48 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012.07.17 15:58:44 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.20 15:47:04 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.06.21 15:39:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sascha\AppData\Roaming\mozilla\Extensions [2012.06.23 16:35:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sascha\AppData\Roaming\mozilla\Firefox\Profiles\xfzlfqxq.default\extensions [2012.06.23 16:35:44 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Sascha\AppData\Roaming\mozilla\Firefox\Profiles\xfzlfqxq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.06.21 15:39:32 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.07.17 15:58:44 | 000,000,000 | ---D | M] (AVG Do Not Track) -- C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK [2012.07.20 15:47:04 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.07.20 15:47:02 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.07.20 15:47:02 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.07.20 15:47:02 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.07.20 15:47:02 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.20 15:47:02 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.20 15:47:02 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.07.22 15:08:13 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Programme\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [AMD AVT] C:\Windows\System32\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [cdpbj] C:\Users\Sascha\AppData\Roaming\cdpbj.dll () O4 - HKCU..\Run: [Steam] D:\Spiele\Steam\Steam.exe (Valve Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sascha\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Programme\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{95E3C5A3-A58D-4F7D-A977-4AAE6ABE8C34}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B96EAFA4-4CCD-420D-AB87-0DAEA1108052}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.08.26 18:41:39 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{5DB5A4D1-6D65-4462-A97E-C88BD3C707AE} [2012.08.22 17:13:07 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2012.08.19 14:32:38 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\PunkBuster [2012.08.19 14:32:27 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Ubisoft [2012.08.16 17:32:05 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\Ubisoft Game Launcher [2012.08.16 17:32:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Ubisoft [2012.08.16 17:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Ubisoft [2012.08.16 12:48:58 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.08.11 14:46:25 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{47B878E3-C472-476C-A982-8E9E9C7BDA19} [2012.08.11 14:46:13 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{1557D964-65CE-44A1-9A6B-E48FA59458CD} [2012.08.10 17:39:21 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{CD0319AB-3811-45C7-9F23-5531B747F0CF} [2012.08.10 17:39:09 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{AC2414BD-6529-4ADF-89AC-23519A537CBB} [2012.08.10 17:39:09 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Local\{42A91397-8D1F-4938-BD8F-A1076746488C} [2012.08.10 17:35:22 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fraps [2012.08.10 13:20:21 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\vlc [2012.08.10 13:20:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2012.08.09 17:43:33 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer [2012.08.09 17:43:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer [2012.08.08 21:33:27 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Skype [2012.08.08 21:33:23 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2012.08.08 21:33:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.08.08 21:33:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.08.08 21:33:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.08.06 15:34:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3 [2012.08.06 15:34:42 | 000,000,000 | ---D | C] -- C:\ProgramData\MTA San Andreas All [2012.08.06 15:26:56 | 000,000,000 | ---D | C] -- C:\Users\Sascha\Documents\GTA San Andreas User Files [2012.08.06 15:26:51 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games [2012.08.03 15:26:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArtMoney SE [2012.08.02 14:48:22 | 000,000,000 | ---D | C] -- C:\Windows\temp [2012.08.02 14:47:44 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2012.08.02 14:41:47 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2012.08.02 14:41:47 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2012.08.02 14:41:47 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2012.08.02 14:41:44 | 000,000,000 | ---D | C] -- C:\ComboFix [2012.08.02 14:41:42 | 000,000,000 | ---D | C] -- C:\Qoobox [2012.08.02 14:41:34 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2012.07.30 23:12:10 | 000,000,000 | ---D | C] -- C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan [2012.07.30 23:12:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan ========== Files - Modified Within 30 Days ========== [2012.08.29 20:37:48 | 000,161,792 | ---- | M] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll [2012.08.29 20:37:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.29 18:13:53 | 000,696,132 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.29 18:13:53 | 000,651,450 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.29 18:13:53 | 000,147,428 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.29 18:13:53 | 000,120,382 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.29 18:12:55 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.29 18:12:55 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.29 18:07:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.29 18:07:47 | 247,595,494 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012.08.29 18:07:47 | 2415,312,896 | -HS- | M] () -- C:\hiberfil.sys [2012.08.29 17:20:53 | 105,217,374 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm [2012.08.19 18:10:57 | 000,168,995 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm [2012.08.19 14:33:05 | 000,138,536 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012.08.19 14:32:41 | 000,270,408 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr [2012.08.16 16:16:55 | 000,000,208 | ---- | M] () -- C:\Users\Sascha\Desktop\Assassin's Creed Brotherhood.url [2012.08.16 13:37:07 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.08.16 13:37:07 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.08.10 13:20:17 | 000,000,615 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk [2012.08.09 17:43:49 | 000,000,693 | ---- | M] () -- C:\Users\Sascha\Desktop\SAMP.lnk [2012.08.08 21:33:23 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.08.06 15:34:55 | 000,000,849 | ---- | M] () -- C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk [2012.08.06 15:26:38 | 000,000,891 | ---- | M] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk [2012.08.03 15:26:43 | 000,000,654 | ---- | M] () -- C:\Users\Public\Desktop\ArtMoney SE v7.39.lnk [2012.08.02 15:30:47 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\FIFA 12.lnk [2012.07.30 23:12:10 | 000,000,667 | ---- | M] () -- C:\Users\Sascha\Desktop\SpeedFan.lnk [2012.07.30 23:12:10 | 000,000,045 | ---- | M] () -- C:\Windows\System32\initdebug.nfo ========== Files Created - No Company Name ========== [2012.08.29 20:37:49 | 000,161,792 | ---- | C] () -- C:\Users\Sascha\AppData\Roaming\cdpbj.dll [2012.08.22 17:13:05 | 247,595,494 | ---- | C] () -- C:\Windows\MEMORY.DMP [2012.08.19 14:33:05 | 000,138,536 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012.08.19 14:32:41 | 000,270,408 | ---- | C] () -- C:\Windows\System32\PnkBstrB.xtr [2012.08.16 17:31:14 | 000,270,408 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2012.08.16 17:31:13 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2012.08.16 16:16:55 | 000,000,208 | ---- | C] () -- C:\Users\Sascha\Desktop\Assassin's Creed Brotherhood.url [2012.08.10 13:20:17 | 000,000,615 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk [2012.08.09 17:43:51 | 000,000,693 | ---- | C] () -- C:\Users\Sascha\Desktop\SAMP.lnk [2012.08.08 21:33:23 | 000,002,505 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.08.06 15:34:55 | 000,000,849 | ---- | C] () -- C:\Users\Public\Desktop\MTA San Andreas 1.3.lnk [2012.08.06 15:17:38 | 000,000,891 | ---- | C] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk [2012.08.03 15:26:43 | 000,000,654 | ---- | C] () -- C:\Users\Public\Desktop\ArtMoney SE v7.39.lnk [2012.08.02 14:41:47 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2012.08.02 14:41:47 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2012.08.02 14:41:47 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2012.08.02 14:41:47 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2012.08.02 14:41:47 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012.07.30 23:12:10 | 000,000,667 | ---- | C] () -- C:\Users\Sascha\Desktop\SpeedFan.lnk [2012.07.30 23:12:09 | 000,000,045 | ---- | C] () -- C:\Windows\System32\initdebug.nfo [2012.07.20 17:11:01 | 000,027,520 | ---- | C] () -- C:\Users\Sascha\AppData\Local\dt.dat [2012.06.24 10:51:45 | 000,000,000 | ---- | C] () -- C:\Users\Sascha\defogger_reenable [2012.06.21 15:25:54 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.06.21 15:18:02 | 000,002,857 | ---- | C] () -- C:\Windows\System32\atipblag.dat [2012.06.11 18:41:48 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat [2012.06.11 18:41:48 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat [2012.06.11 13:50:42 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe [2012.05.10 16:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll [2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat < End of report > Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-24 11:10:51
Windows 6.1.7600 Harddisk0\DR0 -> \Device\00000066 ST310005 rev.CC44
Running: vjqxwf28.exe; Driver: C:\Users\Sascha\AppData\Local\Temp\fwliqpog.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwNotifyChangeKey [0x95B6E004]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwNotifyChangeMultipleKeys [0x95B6E0D4]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0x95B6DD76]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0x95B6DE1E]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0x95B6DEBA]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0x95B6DF56]
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82A55579 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82A79F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 4A0 82A819A0 8 Bytes [04, E0, B6, 95, D4, E0, B6, ...] {ADD AL, 0xe0; MOV DH, 0x95; AAM 0xe0; MOV DH, 0x95}
.text ntkrnlpa.exe!RtlSidHashLookup + 4E8 82A819E8 4 Bytes [76, DD, B6, 95] {JBE 0xffffffffffffffdf; MOV DH, 0x95}
.text ntkrnlpa.exe!RtlSidHashLookup + 7B8 82A81CB8 8 Bytes [1E, DE, B6, 95, BA, DE, B6, ...] {PUSH DS; FIDIV WORD [ESI-0x4921456b]; XCHG EBP, EAX}
.text ntkrnlpa.exe!RtlSidHashLookup + 82C 82A81D2C 4 Bytes [56, DF, B6, 95]
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x9122B000, 0x341E0C, 0xE8000020]
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume7 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume8 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\0000004b halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
---- EOF - GMER 1.0.15 ----
MfG play4fun28 Geändert von play4fun28 (29.08.2012 um 20:38 Uhr) |
| Themen zu Trojaner Generic29.AGEZ+Cryptic.EGJ |
| adobe, autorun, avg, avg secure search, bho, bonjour, c:\windows\system32\cmd.exe, converter, defender, driver./avg, explorer, firefox, flash player, format, helper, langs, locker, logfile, mozilla, mp3, netgear, neue tabs, nodrives, object, origin, plug-in, registry, scan, secure search, sicherheit, software, temp, trojaner, virus, vtoolbarupdater, windows |
Baum-Darstellung