| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Clickcompare-Virus in Firefox / Windows 7Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
22.01.2014, 23:31
| #1 |
| |  Clickcompare-Virus in Firefox / Windows 7 Hallo ihr Lieben, ich habe leider auch das Problem mit dem Clickcompare-Virus, wie einige andere hier auch. Das bedeutet, dass in Texten auf sämtlichen Webseiten (auch zB in PNs oder eigenen Texten) manche Wörter als Link erscheinen. Klickt man diesen an, wird man auf die Clickcompare.info- Seite weitergeleitet. Ich wusste bis heute gar nicht, wie viel Aufwand es zu sein scheint, so etwas wieder aus dem System zu entfernen (ich dachte, mein Virenprogramm wird das schon regeln). Vielleicht kann auch mir jemand von euch helfen, wie ich sehe habt ihr es auch schon bei einigen anderen getan - auch wenn ich keinen Schimmer habe, wie ihr das macht. Vermutlich mit Zauberei.  Dank eurer Anleitung ("Was muss ich vor meinem ersten Thema beachten") weiß ich immerhin, wie ich schonmal einen guten Anfang machen kann. Ich habe also die 3 Programme defogger, FRST und GMER runtergeladen und laufen lassen. Da ihr Anhänge nur wollt wenn nötig füge ich sie hier direkt ein: 1. defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:48 on 22/01/2014 (Sey)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-01-2014 02
Ran by Sey (administrator) on HASS on 22-01-2014 22:58:55
Running from F:\
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Kaspersky Lab ZAO) G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Kaspersky Lab ZAO) G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Malwarebytes Corporation) G:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Google Inc.) G:\Program Files (x86)\Google\Update\GoogleUpdate.exe
(Google Inc.) G:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) G:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(AMD) G:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) G:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
() C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
(Advanced Micro Devices Inc.) G:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) G:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razertra.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerofa.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_54.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_54.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE
==================== Registry (Whitelisted) ==================
HKLM-x32\...\Run: [Diamondback] - C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe [226816 2009-10-09] ()
HKLM-x32\...\Run: [StartCCC] - G:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKCU\...\Run: [HydraVisionDesktopManager] - G:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-11-22] (AMD)
MountPoints2: {8d11fb9e-acc0-11e2-958a-001d607433de} - J:\setup.exe
Startup: C:\Users\Sey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung SSD Magician.lnk
ShortcutTarget: Samsung SSD Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe (Samsung Electronics.)
==================== Internet (Whitelisted) ====================
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: 192.168.1.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x30E6B0D5E3E7CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - G:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - G:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - G:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default
FF NewTab: about:blank
FF Homepage: hxxp://www.google.de
FF Keyword.URL: hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=6747f35a-4790-498b-9b3e-a438e2796ba5&searchtype=ds&fr=linkury-tb&installDate=25/04/2013&type=hp1000&p=
FF NetworkProxy: "http", "192.168.1.1"
FF NetworkProxy: "http_port", 8118
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, kinox.to"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_54.dll ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_54.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - G:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - G:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - G:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - G:\PROGRA~2\MICROS~4\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - G:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - G:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - G:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Plus-HD-3.8 - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\c17236e8-fd66-44bc-aeef-1e00981cbb64@0a4ee0fe-5356-4fd3-b37c-5cd5671a315c.com [2014-01-17]
FF Extension: TACO with Abine - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\optout@dubfire.net [2013-05-24]
FF Extension: YouTube Unblocker - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-16]
FF Extension: Flashblock - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013-04-22]
FF Extension: mediaplayerconnectivity - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\{84b24861-62f6-364b-eba5-2e5e2061d7e6} [2013-01-01]
FF Extension: DownloadHelper - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-29]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-01-01]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\elemhidehelper@adblockplus.org.xpi [2013-01-01]
FF Extension: Ghostery - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\firefox@ghostery.com.xpi [2013-08-17]
FF Extension: YouTube HTML5 Switch - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\jid0-coCUQ7NySNPcj72dA3557kKXGZU@jetpack.xpi [2013-05-10]
FF Extension: YouTube HTML5-Video - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\jid0-MXvUXM1npF7yTcY3bpZVht72AR4@jetpack.xpi [2013-06-25]
FF Extension: YouTube ALL HTML5 - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\jid1-qj0w91o64N7Eeg@jetpack.xpi [2013-09-15]
FF Extension: SmartVideo For YouTube - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\mytube@ashishmishra.in.xpi [2013-05-10]
FF Extension: SkipScreen - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\SkipScreen@SkipScreen.xpi [2013-01-01]
FF Extension: Session Manager - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2013-04-04]
FF Extension: Adblock Plus - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-01-01]
FF Extension: Disable Anti-Adblock - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\{d49a148e-817e-4025-bee3-5d541376de3b}.xpi [2013-09-15]
FF Extension: Greasemonkey - C:\Users\Sey\AppData\Roaming\Mozilla\Firefox\Profiles\4kbhbbe1.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-10-10]
FF HKLM-x32\...\Firefox\Extensions: - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-18]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-18]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-18]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-18]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-18]
==================== Services (Whitelisted) =================
R2 AVP; G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-11-26] (Kaspersky Lab ZAO)
S4 gupdate; G:\Program Files (x86)\Google\Update\GoogleUpdate.exe [116648 2014-01-02] (Google Inc.)
S4 gupdatem; G:\Program Files (x86)\Google\Update\GoogleUpdate.exe [116648 2014-01-02] (Google Inc.)
R2 MBAMScheduler; G:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; G:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 PsShutdownSvc; C:\Windows\PSSDNSVC.EXE [87616 2013-01-01] (Systems Internals)
S4 UrBackupClientBackend; C:\Program Files\UrBackup\UrBackupClientBackend.exe [1047552 2013-04-25] ()
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()
R3 AtcL001; C:\Windows\System32\DRIVERS\l160x64.sys [61440 2009-10-13] (Atheros Communications, Inc.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-04-25] (DT Soft Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-11-26] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620640 2014-01-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-11-26] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-11-26] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-11-26] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-18] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()
R3 Razerlow; C:\Windows\System32\drivers\Razerlow.sys [21120 2005-11-07] (Razer (Asia-Pacific) Pte Ltd)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-01-01] (Duplex Secure Ltd.)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2013-10-31] (WinISO.com)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-22 22:58 - 2014-01-22 22:58 - 00000000 ____D C:\FRST
2014-01-22 22:48 - 2014-01-22 22:48 - 00000188 _____ C:\Users\Sey\defogger_reenable
2014-01-22 20:02 - 2014-01-22 22:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-22 20:02 - 2014-01-22 20:03 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-22 20:02 - 2014-01-22 20:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-22 20:02 - 2014-01-22 20:03 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-22 01:01 - 2014-01-22 01:01 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Malwarebytes
2014-01-22 01:01 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-21 19:45 - 2014-01-21 19:45 - 00002796 _____ C:\Users\Sey\AppData\Local\recently-used.xbel
2014-01-21 19:26 - 2014-01-21 19:26 - 00000000 ____D C:\Users\Sey\AppData\Roaming\EPSON
2014-01-20 20:20 - 2014-01-20 20:30 - 00000000 ____D C:\Users\Sey\AppData\Roaming\LyX2.0
2014-01-20 20:20 - 2014-01-20 20:20 - 00000000 ____D C:\Users\Sey\AppData\Roaming\MiKTeX
2014-01-20 19:47 - 2014-01-20 19:47 - 00000000 ____D C:\Users\Sey\AppData\Local\MiKTeX
2014-01-18 18:05 - 2014-01-18 18:30 - 00002154 _____ C:\Users\Sey\Desktop\Safe Money.lnk
2014-01-18 18:05 - 2014-01-18 18:12 - 00000000 ____D C:\AdwCleaner
2014-01-18 18:04 - 2014-01-18 18:04 - 00000000 ____D C:\Windows\ELAMBKUP
2014-01-18 18:04 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-01-18 18:03 - 2014-01-18 18:19 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-18 18:03 - 2013-06-08 20:18 - 00112224 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-01-18 17:56 - 2014-01-18 17:56 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Wireshark
2014-01-18 17:50 - 2014-01-18 17:50 - 00000000 ____D C:\Program Files\Wireshark
2014-01-18 17:41 - 2014-01-18 17:45 - 00000000 ____D C:\Program Files\stinger
2014-01-18 17:41 - 2014-01-18 17:41 - 00000000 ____D C:\Quarantine
2014-01-18 15:07 - 2014-01-18 15:07 - 00389240 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2014-01-18 15:07 - 2014-01-18 15:07 - 00150256 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2014-01-17 18:10 - 2014-01-17 18:10 - 00000146 _____ C:\Users\Sey\Desktop\Goodgame Empire.url
2014-01-17 18:09 - 2014-01-17 21:52 - 00000000 ____D C:\Users\Sey\AppData\Local\DownloadGuide
2014-01-15 14:02 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 14:02 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 14:02 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 14:02 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 14:02 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 14:02 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 14:02 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 14:02 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 14:02 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-05 21:01 - 2014-01-05 21:01 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Unity
2014-01-05 20:58 - 2014-01-21 03:35 - 00000000 ____D C:\Users\Sey\AppData\Local\Unity
2014-01-02 21:08 - 2014-01-02 21:08 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-02 21:07 - 2014-01-22 22:53 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-02 21:07 - 2014-01-22 22:18 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-02 21:07 - 2014-01-22 19:30 - 00000000 ____D C:\Users\Sey\AppData\Local\Google
2014-01-02 21:07 - 2014-01-02 21:13 - 00004100 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-02 21:07 - 2014-01-02 21:13 - 00003848 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
==================== One Month Modified Files and Folders =======
2014-01-22 22:59 - 2013-01-01 08:15 - 00697256 _____ C:\Windows\system32\perfh007.dat
2014-01-22 22:59 - 2013-01-01 08:15 - 00149224 _____ C:\Windows\system32\perfc007.dat
2014-01-22 22:59 - 2009-07-14 06:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-22 22:58 - 2014-01-22 22:58 - 00000000 ____D C:\FRST
2014-01-22 22:56 - 2013-01-01 06:40 - 01665133 _____ C:\Windows\WindowsUpdate.log
2014-01-22 22:53 - 2014-01-02 21:07 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-22 22:53 - 2013-03-14 23:49 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2014-01-22 22:53 - 2010-11-21 04:47 - 00980274 _____ C:\Windows\PFRO.log
2014-01-22 22:53 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-22 22:53 - 2009-07-14 05:51 - 00035901 _____ C:\Windows\setupact.log
2014-01-22 22:49 - 2009-07-14 05:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-22 22:49 - 2009-07-14 05:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-22 22:48 - 2014-01-22 22:48 - 00000188 _____ C:\Users\Sey\defogger_reenable
2014-01-22 22:48 - 2013-01-01 07:10 - 00000000 ____D C:\Users\Sey\AppData\Roaming\vlc
2014-01-22 22:48 - 2013-01-01 06:41 - 00000000 ____D C:\Users\Sey
2014-01-22 22:18 - 2014-01-02 21:07 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-22 22:16 - 2014-01-22 20:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-22 20:11 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\tracing
2014-01-22 20:03 - 2014-01-22 20:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-22 20:03 - 2014-01-22 20:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-22 20:03 - 2014-01-22 20:02 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-22 19:31 - 2013-12-09 21:17 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Zylom Games
2014-01-22 19:30 - 2014-01-02 21:07 - 00000000 ____D C:\Users\Sey\AppData\Local\Google
2014-01-22 19:23 - 2013-12-10 05:00 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-22 19:22 - 2013-12-10 17:22 - 00000000 ____D C:\Program Files (x86)\Deus.Ex.Human.Revolution.Directors.Cut
2014-01-22 01:01 - 2014-01-22 01:01 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Malwarebytes
2014-01-21 19:45 - 2014-01-21 19:45 - 00002796 _____ C:\Users\Sey\AppData\Local\recently-used.xbel
2014-01-21 19:45 - 2013-03-23 20:42 - 00000000 ____D C:\Users\Sey\.gimp-2.8
2014-01-21 19:26 - 2014-01-21 19:26 - 00000000 ____D C:\Users\Sey\AppData\Roaming\EPSON
2014-01-21 03:35 - 2014-01-05 20:58 - 00000000 ____D C:\Users\Sey\AppData\Local\Unity
2014-01-20 20:30 - 2014-01-20 20:20 - 00000000 ____D C:\Users\Sey\AppData\Roaming\LyX2.0
2014-01-20 20:20 - 2014-01-20 20:20 - 00000000 ____D C:\Users\Sey\AppData\Roaming\MiKTeX
2014-01-20 19:47 - 2014-01-20 19:47 - 00000000 ____D C:\Users\Sey\AppData\Local\MiKTeX
2014-01-18 18:30 - 2014-01-18 18:05 - 00002154 _____ C:\Users\Sey\Desktop\Safe Money.lnk
2014-01-18 18:19 - 2014-01-18 18:03 - 00620640 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-01-18 18:19 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-01-18 18:16 - 2013-01-01 08:46 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2014-01-18 18:12 - 2014-01-18 18:05 - 00000000 ____D C:\AdwCleaner
2014-01-18 18:04 - 2014-01-18 18:04 - 00000000 ____D C:\Windows\ELAMBKUP
2014-01-18 17:56 - 2014-01-18 17:56 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Wireshark
2014-01-18 17:50 - 2014-01-18 17:50 - 00000000 ____D C:\Program Files\Wireshark
2014-01-18 17:45 - 2014-01-18 17:41 - 00000000 ____D C:\Program Files\stinger
2014-01-18 17:41 - 2014-01-18 17:41 - 00000000 ____D C:\Quarantine
2014-01-18 16:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2014-01-18 15:07 - 2014-01-18 15:07 - 00389240 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2014-01-18 15:07 - 2014-01-18 15:07 - 00150256 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2014-01-17 21:52 - 2014-01-17 18:09 - 00000000 ____D C:\Users\Sey\AppData\Local\DownloadGuide
2014-01-17 18:10 - 2014-01-17 18:10 - 00000146 _____ C:\Users\Sey\Desktop\Goodgame Empire.url
2014-01-16 11:24 - 2009-07-14 05:45 - 00488912 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:01 - 2013-07-25 02:00 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 03:01 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini
2014-01-16 03:00 - 2013-01-01 07:06 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-11 23:54 - 2013-09-09 18:57 - 00000000 ____D C:\Users\Sey\AppData\Roaming\X-Chat 2
2014-01-08 10:16 - 2013-05-29 13:06 - 00008192 _____ C:\Users\Sey\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-08 10:15 - 2013-01-01 13:24 - 00000000 ____D C:\Users\Sey\AppData\Roaming\WinFF
2014-01-05 21:01 - 2014-01-05 21:01 - 00000000 ____D C:\Users\Sey\AppData\Roaming\Unity
2014-01-02 21:13 - 2014-01-02 21:07 - 00004100 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-02 21:13 - 2014-01-02 21:07 - 00003848 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-02 21:08 - 2014-01-02 21:08 - 00000000 ____D C:\Program Files (x86)\Google
Files to move or delete:
====================
C:\Users\Sey\Windows_7_MouseFix_TextSize(DPI)=100%_Scale=1-to-1_@7-of-11.reg
Some content of TEMP:
====================
C:\Users\Sey\AppData\Local\Temp\ApnStub.exe
C:\Users\Sey\AppData\Local\Temp\AskSLib.dll
C:\Users\Sey\AppData\Local\Temp\AutoRun.exe
C:\Users\Sey\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Sey\AppData\Local\Temp\CmdLineExt.dll
C:\Users\Sey\AppData\Local\Temp\Core.dll
C:\Users\Sey\AppData\Local\Temp\dlc.exe
C:\Users\Sey\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Sey\AppData\Local\Temp\drm_dyndata_7300015.dll
C:\Users\Sey\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Sey\AppData\Local\Temp\fp_pl_pfs_installer-2.exe
C:\Users\Sey\AppData\Local\Temp\fp_pl_pfs_installer-3.exe
C:\Users\Sey\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Sey\AppData\Local\Temp\Install_HOSTS_Anti-Adware.exe
C:\Users\Sey\AppData\Local\Temp\JewelOfAtlantisSetup20123.exe
C:\Users\Sey\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Sey\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Sey\AppData\Local\Temp\ose00000.exe
C:\Users\Sey\AppData\Local\Temp\ose00001.exe
C:\Users\Sey\AppData\Local\Temp\Quarantine.exe
C:\Users\Sey\AppData\Local\Temp\raptrpatch.exe
C:\Users\Sey\AppData\Local\Temp\raptr_stub.exe
C:\Users\Sey\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Sey\AppData\Local\Temp\SettingUpdate.exe
C:\Users\Sey\AppData\Local\Temp\Setup.exe
C:\Users\Sey\AppData\Local\Temp\UninstallEADM.dll
C:\Users\Sey\AppData\Local\Temp\vlc-2.0.6-win64.exe
C:\Users\Sey\AppData\Local\Temp\vlc-2.0.7-win64.exe
C:\Users\Sey\AppData\Local\Temp\vlc-2.0.8-win64.exe
C:\Users\Sey\AppData\Local\Temp\Window.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-19 08:59
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-22 23:14:35
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP6T0L0-8 Samsung_SSD_840_Series rev.DXT07B0Q 111,79GB
Running: gmer.exe; Driver: C:\Users\Sey\AppData\Local\Temp\pxldipoc.sys
---- User code sections - GMER 2.1 ----
.text G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1500] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 0000000077c7faa8 5 bytes JMP 00000001741818a8
.text G:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1500] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077c80038 5 bytes JMP 0000000174181ea1
.text G:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076de1465 2 bytes [DE, 76]
.text G:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe[1684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076de14bb 2 bytes [DE, 76]
.text ... * 2
.text G:\Program Files (x86)\Google\Update\GoogleUpdate.exe[3024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076de1465 2 bytes [DE, 76]
.text G:\Program Files (x86)\Google\Update\GoogleUpdate.exe[3024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076de14bb 2 bytes [DE, 76]
.text ... * 2
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077a811f5 8 bytes {JMP 0xd}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077a81390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077a8143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077a8158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077a8191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077a81b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077a81bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077a81d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077a81eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077a81edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077a81f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077a81fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077a81fd7 8 bytes {JMP 0xb}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077a82272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077a82301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077a82792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077a827b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077a827d2 8 bytes {JMP 0x10}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077a8282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077a82890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077a82d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077a82d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077a83023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077a8323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077a833c0 16 bytes {JMP 0x4e}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077a83a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077a83ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077a83b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077a83d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077a84190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077ad1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077ad1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077ad1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077ad1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077ad1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077ad1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077ad1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077ad27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000742513cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007425146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000742516d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000742516e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000742519db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000742519fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074251a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074251a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074251a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe[3840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074251a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Processes - GMER 2.1 ----
Process C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe (*** suspicious ***) @ C:\Users\Sey\AppData\Local\Temp\Rar$EXa0.522\gmer.exe [3840](2014-01-22 22:07:57) 0000000000400000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision 3021004
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xCA 0xCC 0xA5 0xBA ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xFF 0x7A 0x09 0xB8 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x4D 0xD6 0x8A 0x7A ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xCA 0xCC 0xA5 0xBA ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xFF 0x7A 0x09 0xB8 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x4D 0xD6 0x8A 0x7A ...
---- EOF - GMER 2.1 ----
 Ich hoffe es ist alles richtig so, ich hatte keine Fehlermeldungen währenddessen und auch alles zugemacht an Programmen. Ich danke euch im voraus für eure Hilfe!  |
| Themen zu Clickcompare-Virus in Firefox / Windows 7 |
| adblock, adobe, browser, defender, ebanking, entfernen, explorer, flash player, goodgame, homepage, kaspersky, mozilla, newtab, ntdll.dll, programm, pup.optional.conduit, pup.optional.conduit.a, pup.optional.delta.a, pup.optional.installmonetizer, pup.optional.opencandy, pup.optional.plushd.a, pup.optional.searchprotect.a, required, services.exe, software, svchost.exe, system, windows |
Baum-Darstellung