| |
| |||||||
Log-Analyse und Auswertung: GUV-Trojaner eingefangenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.12.2012, 13:56
| #5 |
| |  GUV-Trojaner eingefangen Hallo ryder, nach Anweisung durchgeführt und Alles (scheint) absolut einwandfrei zu funktionieren. Auf diesem Wege !!vielmals Danke!! und einen Guten Rutsch ins Neue Jahr!! Den Auszug aus Combofix findest du nachstehend: #Combofix Logfile: Code:
ATTFilter ComboFix 12-12-29.02 - vanessa 29.12.2012 12:49:50.1.2 - x64 NETWORK
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4007.2889 [GMT 1:00]
ausgeführt von:: c:\users\vanessa\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\dsgsdgdsgdsgw.pad
c:\users\vanessa\wgsdgsdgdsgsd.dll
Q:\Autorun.inf
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-11-28 bis 2012-12-29 ))))))))))))))))))))))))))))))
.
.
2012-12-29 11:54 . 2012-12-29 11:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-28 15:54 . 2012-12-28 15:54 -------- d-----w- c:\users\vanessa\AppData\Roaming\Malwarebytes
2012-12-28 15:54 . 2012-12-28 15:54 -------- d-----w- c:\programdata\Malwarebytes
2012-12-28 15:53 . 2012-12-28 15:54 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-12-28 15:53 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-28 09:46 . 2012-12-28 09:46 -------- d-----w- C:\_OTL
2012-12-28 09:43 . 2012-12-28 09:43 -------- d-----w- c:\users\vanessa\AppData\Local\Programs
2012-12-27 20:50 . 2012-12-27 20:50 2939 ----a-w- c:\programdata\dsgsdgdsgdsgw.js
2012-12-24 10:40 . 2012-12-24 10:40 -------- d-----r- c:\users\vanessa\AppData\Roaming\Brother
2012-12-22 11:55 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-22 11:55 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-22 11:55 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-22 11:55 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-14 14:22 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2012-12-14 10:24 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll
2012-12-14 10:24 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll
2012-12-05 20:33 . 2012-12-06 13:27 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-14 12:40 . 2012-10-12 18:53 67413224 ----a-w- c:\windows\system32\MRT.exe
2012-12-12 18:55 . 2012-10-14 08:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-12 18:55 . 2012-10-14 08:03 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-28 12:34 . 2012-10-28 12:34 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin
2012-10-16 20:34 . 2012-10-16 20:34 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-10-16 20:34 . 2012-10-16 20:34 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-10-16 20:34 . 2012-10-16 20:34 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-10-16 08:38 . 2012-11-28 10:42 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-28 10:42 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-28 10:42 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-11 19:56 . 2010-06-24 09:33 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-10-10 16:45 . 2012-10-10 16:45 86528 ----a-w- c:\windows\SysWow64\SearchFilterHost.exe
2012-10-10 16:45 . 2012-10-10 16:45 778752 ----a-w- c:\windows\system32\mssvp.dll
2012-10-10 16:45 . 2012-10-10 16:45 75264 ----a-w- c:\windows\system32\msscntrs.dll
2012-10-10 16:45 . 2012-10-10 16:45 666624 ----a-w- c:\windows\SysWow64\mssvp.dll
2012-10-10 16:45 . 2012-10-10 16:45 59392 ----a-w- c:\windows\SysWow64\msscntrs.dll
2012-10-10 16:45 . 2012-10-10 16:45 591872 ----a-w- c:\windows\system32\SearchIndexer.exe
2012-10-10 16:45 . 2012-10-10 16:45 491520 ----a-w- c:\windows\system32\mssph.dll
2012-10-10 16:45 . 2012-10-10 16:45 427520 ----a-w- c:\windows\SysWow64\SearchIndexer.exe
2012-10-10 16:45 . 2012-10-10 16:45 337408 ----a-w- c:\windows\SysWow64\mssph.dll
2012-10-10 16:45 . 2012-10-10 16:45 288256 ----a-w- c:\windows\system32\mssphtb.dll
2012-10-10 16:45 . 2012-10-10 16:45 249856 ----a-w- c:\windows\system32\SearchProtocolHost.exe
2012-10-10 16:45 . 2012-10-10 16:45 2315776 ----a-w- c:\windows\system32\tquery.dll
2012-10-10 16:45 . 2012-10-10 16:45 2223616 ----a-w- c:\windows\system32\mssrch.dll
2012-10-10 16:45 . 2012-10-10 16:45 197120 ----a-w- c:\windows\SysWow64\mssphtb.dll
2012-10-10 16:45 . 2012-10-10 16:45 164352 ----a-w- c:\windows\SysWow64\SearchProtocolHost.exe
2012-10-10 16:45 . 2012-10-10 16:45 1549312 ----a-w- c:\windows\SysWow64\tquery.dll
2012-10-10 16:45 . 2012-10-10 16:45 1401344 ----a-w- c:\windows\SysWow64\mssrch.dll
2012-10-10 16:45 . 2012-10-10 16:45 113664 ----a-w- c:\windows\system32\SearchFilterHost.exe
2012-10-10 16:45 . 2012-10-10 16:45 476160 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-10-10 16:45 . 2012-10-10 16:45 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2012-10-10 16:44 . 2012-10-10 16:44 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
2012-10-10 16:44 . 2012-10-10 16:44 31232 ----a-w- c:\windows\system32\prevhost.exe
2012-10-10 16:44 . 2012-10-10 16:44 96768 ----a-w- c:\windows\system32\fsutil.exe
2012-10-10 16:44 . 2012-10-10 16:44 91648 ----a-w- c:\windows\system32\drivers\USBSTOR.SYS
2012-10-10 16:44 . 2012-10-10 16:44 74240 ----a-w- c:\windows\SysWow64\fsutil.exe
2012-10-10 16:44 . 2012-10-10 16:44 410496 ----a-w- c:\windows\system32\drivers\iaStorV.sys
2012-10-10 16:44 . 2012-10-10 16:44 27008 ----a-w- c:\windows\system32\drivers\amdxata.sys
2012-10-10 16:44 . 2012-10-10 16:44 2565632 ----a-w- c:\windows\system32\esent.dll
2012-10-10 16:44 . 2012-10-10 16:44 189824 ----a-w- c:\windows\system32\drivers\storport.sys
2012-10-10 16:44 . 2012-10-10 16:44 1699328 ----a-w- c:\windows\SysWow64\esent.dll
2012-10-10 16:44 . 2012-10-10 16:44 166272 ----a-w- c:\windows\system32\drivers\nvstor.sys
2012-10-10 16:44 . 2012-10-10 16:44 148352 ----a-w- c:\windows\system32\drivers\nvraid.sys
2012-10-10 16:44 . 2012-10-10 16:44 107904 ----a-w- c:\windows\system32\drivers\amdsata.sys
2012-10-10 16:44 . 2012-10-10 16:44 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-10-10 16:44 . 2012-10-10 16:44 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-10-10 16:42 . 2012-10-10 16:42 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-10-10 16:42 . 2012-10-10 16:42 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-10-10 16:42 . 2012-10-10 16:42 1572864 ----a-w- c:\windows\system32\quartz.dll
2012-10-10 16:42 . 2012-10-10 16:42 1328128 ----a-w- c:\windows\SysWow64\quartz.dll
2012-10-10 16:42 . 2012-10-10 16:42 43520 ----a-w- c:\windows\system32\csrsrv.dll
2012-10-10 16:42 . 2012-10-10 16:42 723456 ----a-w- c:\windows\system32\EncDec.dll
2012-10-10 16:42 . 2012-10-10 16:42 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2012-10-10 16:40 . 2012-10-10 16:40 395776 ----a-w- c:\windows\system32\webio.dll
2012-10-10 16:40 . 2012-10-10 16:40 314880 ----a-w- c:\windows\SysWow64\webio.dll
2012-10-10 16:40 . 2012-10-10 16:40 31232 ----a-w- c:\windows\system32\lsass.exe
2012-10-10 16:40 . 2012-10-10 16:40 29184 ----a-w- c:\windows\system32\sspisrv.dll
2012-10-10 16:40 . 2012-10-10 16:40 28160 ----a-w- c:\windows\system32\secur32.dll
2012-10-10 16:40 . 2012-10-10 16:40 1447936 ----a-w- c:\windows\system32\lsasrv.dll
2012-10-10 16:40 . 2012-10-10 16:40 136192 ----a-w- c:\windows\system32\sspicli.dll
2012-10-10 16:40 . 2012-10-10 16:40 77312 ----a-w- c:\windows\system32\packager.dll
2012-10-10 16:40 . 2012-10-10 16:40 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-10-10 16:40 . 2012-10-10 16:40 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax
2012-10-10 16:40 . 2012-10-10 16:40 613888 ----a-w- c:\windows\system32\psisdecd.dll
2012-10-10 16:40 . 2012-10-10 16:40 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll
2012-10-10 16:40 . 2012-10-10 16:40 108032 ----a-w- c:\windows\system32\psisrndr.ax
2012-10-10 16:39 . 2012-10-10 16:39 861696 ----a-w- c:\windows\system32\oleaut32.dll
2012-10-10 16:39 . 2012-10-10 16:39 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2012-10-10 16:39 . 2012-10-10 16:39 331776 ----a-w- c:\windows\system32\oleacc.dll
2012-10-10 16:39 . 2012-10-10 16:39 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2012-10-10 16:39 . 2012-10-10 16:39 199680 ----a-w- c:\windows\system32\xmllite.dll
2012-10-10 16:38 . 2012-10-10 16:38 86016 ----a-w- c:\windows\SysWow64\odbccu32.dll
2012-10-10 16:38 . 2012-10-10 16:38 81920 ----a-w- c:\windows\SysWow64\odbccr32.dll
2012-10-10 16:38 . 2012-10-10 16:38 319488 ----a-w- c:\windows\SysWow64\odbcjt32.dll
2012-10-10 16:38 . 2012-10-10 16:38 212992 ----a-w- c:\windows\system32\odbctrac.dll
2012-10-10 16:38 . 2012-10-10 16:38 163840 ----a-w- c:\windows\SysWow64\odbctrac.dll
2012-10-10 16:38 . 2012-10-10 16:38 163840 ----a-w- c:\windows\system32\odbccp32.dll
2012-10-10 16:38 . 2012-10-10 16:38 122880 ----a-w- c:\windows\SysWow64\odbccp32.dll
2012-10-10 16:38 . 2012-10-10 16:38 106496 ----a-w- c:\windows\system32\odbccu32.dll
2012-10-10 16:38 . 2012-10-10 16:38 106496 ----a-w- c:\windows\system32\odbccr32.dll
2012-10-10 16:38 . 2012-10-10 16:38 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2012-10-10 16:38 . 2012-10-10 16:38 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2012-10-10 16:38 . 2012-10-10 16:38 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-10-10 16:38 . 2012-10-10 16:38 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
2012-10-10 16:38 . 2012-10-10 16:38 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2012-10-10 16:38 . 2012-10-10 16:38 246784 ----a-w- c:\windows\system32\input.dll
2012-10-10 16:38 . 2012-10-10 16:38 202240 ----a-w- c:\windows\SysWow64\input.dll
2012-10-10 16:37 . 2012-10-10 16:37 976896 ----a-w- c:\windows\system32\inetcomm.dll
2012-10-10 16:37 . 2012-10-10 16:37 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
2012-10-10 16:37 . 2012-10-10 16:37 27520 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2012-10-10 16:37 . 2012-10-10 16:37 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-10-10 16:37 . 2012-10-10 16:37 158208 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-10-10 16:37 . 2012-10-10 16:37 128000 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-10-10 16:37 . 2012-10-10 16:37 467456 ----a-w- c:\windows\system32\drivers\srv.sys
2012-10-10 16:37 . 2012-10-10 16:37 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-10-10 16:37 . 2012-10-10 16:37 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-10-10 16:36 . 2012-10-10 16:36 80384 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2012-10-10 16:36 . 2012-10-10 16:36 98816 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2012-10-10 16:36 . 2012-10-10 16:36 7936 ----a-w- c:\windows\system32\drivers\usbd.sys
2012-10-10 16:36 . 2012-10-10 16:36 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSU"="c:\program files (x86)\Medion AG\NSU\NSU.exe" [2011-10-20 1789440]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-10-10 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
"PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-08-31 1629544]
"Lenovo Registration"="c:\program files (x86)\Lenovo Registration\LenovoReg.exe" [2011-07-13 4351712]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"Memeo Instant Backup"="c:\program files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe" [2011-09-28 136416]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\users\vanessa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2011-4-27 1218336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys [2010-09-07 15472]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe [2010-12-16 198784]
R2 HyperW7Svc;HyperW7 Service;c:\program files\Lenovo\RapidBoot\HyperW7Svc64.exe [2011-07-08 144232]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2011-05-31 41320]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2011-07-12 101736]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [2011-05-31 59240]
R2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2011-07-12 133992]
R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-09-28 25824]
R2 SAService;Conexant SmartAudio service;c:\windows\system32\SAsrv.exe [x]
R2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2011-07-12 145256]
R2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2011-07-12 142696]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-22 2656280]
R3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [2011-04-27 436776]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2011-04-27 39976]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-08-19 317440]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2011-08-31 87400]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [2011-08-31 173416]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [2011-03-29 23664]
S1 PHCORE;PHCORE;c:\program files\Lenovo\RapidBoot\PHCORE64.SYS [2011-07-08 32104]
S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2011-04-13 1143912]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-14 18:55]
.
2012-12-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-10 07:20]
.
2012-12-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-10 07:20]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"="TpShocks.exe" [2011-03-29 380776]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2011-04-26 310912]
"ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-19 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-19 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-19 416024]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2011-05-31 40808]
"ALCKRESI.EXE"="c:\program files\Lenovo\AutoLock\ALCKRESI.EXE" [2011-05-25 281960]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\vanessa\AppData\Roaming\Mozilla\Firefox\Profiles\4xgzrm01.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.hochzeitsplaza.de/hochzeits-forum/
FF - prefs.js: keyword.URL - hxxp://www.tepela.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=rxvT2uhP&q=
FF - ExtSQL: 2012-11-13 13:04; ich@maltegoetz.de; c:\users\vanessa\AppData\Roaming\Mozilla\Firefox\Profiles\4xgzrm01.default\extensions\ich@maltegoetz.de
FF - user.js: keyword.URL - hxxp://www.tepela.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=rxvT2uhP&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-12-29 12:56:17
ComboFix-quarantined-files.txt 2012-12-29 11:56
.
Vor Suchlauf: 11 Verzeichnis(se), 613.657.137.152 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 613.409.214.464 Bytes frei
.
- - End Of File - - E084E958EAB53ED02E8F19975A52F4BE
# Nochmals Danke und beste Grüße Andreas1003 |
| Themen zu GUV-Trojaner eingefangen |
| eingefangen, gefangen, gen, guv trojaner, guv-trojaner |
Baum-Darstellung