| |
| |||||||
Log-Analyse und Auswertung: Win7: BKA-Trojaner?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
13.04.2014, 13:54
| #1 |
 |  Win7: BKA-Trojaner? Moin, ich habe heute eine merkwürdige Mail erhalten, ohne Text, sondern nur mit einem Link. Da ich den Absender kenne und deshalb nichts Böses ahnte, habe ich den Link einfach angeklickt. Es erschien eine Seite des BKA wegen illegaler Aktivitäten auf meinem Computer und so. Ich habe sie sofort wieder geschlossen, was gar nicht so einfach war, da die Seite "bestätigt" werden wollte, dass ich sie schließe. Da ich die Seite nur kurz gesehen habe, weiß ich nicht mehr im Detail, was dort stand, aber nochmal öffnen will ich sie lieber nicht.  Die Mail landete übrigens bei GMX in Spamverdacht, was mich aber nicht davon abhielt, sie zu öffnen, da so etwas ja auch bei bekannten Absendern öfter vorkommt. Ich vermute inzwischen, dass das automatisch verschickt wurde und der Absender selbst überhaupt nichts davon weiß. (Falls es interessiert, kann ich den verdächtigen Link auch mal posten. Ich weiß aber nicht, ob das im Interesse anderer Mitleser gut ist, die ihn aus Versehen anklicken könnten.)Mein Computer läuft zwar nach wie vor ohne Probleme, aber nach dem Aufrufen dieser Seite befürchte ich, dass ich mir da etwas eingefangen haben könnte. Ich mache das Ganze jetzt vorsichtshalber erstmal nicht von meinem üblichen Admin-, sondern von einem Gastkonto aus. Und dann hätte ich noch eine Frage: Wie ich für den GMER-Scan Avira deaktivierte, sah ich bei Avira selbst die Bemerkung, dass mein Firewall deaktiviert sei. Ich kann mich nicht erinnern, dies gemacht zu haben!? Nach dem GMER-Scan aktivierte ich Avira wieder, aber Firewall ließ nicht nicht aktivieren (auch nicht, als ich mein gefordertes Admin-Passwort eingab). Als Test loggte ich mich dann kurz nochmal auf mein Admin-Konto ein, wo komischerweise steht, dass Firewall aktiviert sei. Wie soll ich das verstehen?  Hier erstmal die Logfiles: defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:58 on 13/04/2014 (****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2014 01
Ran by Gast (ATTENTION: The logged in user is not administrator) on XY-PC on 13-04-2014 14:02:48
Running from C:\Users\Gast\Desktop
Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [CDAServer] - C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [350072 2012-03-09] ()
HKLM\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\ssmmgr.exe [614400 2009-08-14] ()
==================== Internet (Whitelisted) ====================
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 208.67.220.220
FireFox:
========
FF ProfilePath: C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\2w39fb8y.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\2w39fb8y.default\Extensions\staged [2014-04-13]
FF Extension: GMX MailCheck - C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\2w39fb8y.default\Extensions\toolbar@gmx.net [2014-04-13]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-01-24]
========================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [120088 2013-10-11] (SUPERAntiSpyware.com)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-18] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-18] (Avira GmbH)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-13 13:52 - 2014-04-13 13:52 - 00000000 ____D () C:\Users\Gast
2014-04-13 02:34 - 2014-04-13 02:34 - 00000000 ___RD () C:\Program Files\Skype
2014-04-13 02:34 - 2014-04-13 02:34 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-04-11 02:58 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-11 02:58 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-11 02:58 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-11 02:58 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-11 02:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-11 02:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-11 02:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-11 02:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-11 02:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-11 02:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-11 02:58 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-11 02:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-11 02:58 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-11 02:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-11 02:58 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-11 02:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-11 02:58 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-11 02:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-11 02:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-11 02:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-11 02:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-11 02:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-11 02:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-11 02:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-11 02:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-11 02:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-09 18:47 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:47 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:47 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:47 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:47 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:47 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-03 03:01 - 2014-04-03 03:01 - 00285206 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-04-03 03:00 - 2014-04-03 03:00 - 00290186 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-04-03 03:00 - 2014-04-03 03:00 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-04-02 17:10 - 2014-04-02 17:10 - 00000000 ____D () C:\Windows\Samsung
2014-04-02 17:10 - 2009-08-16 13:07 - 00482408 _____ () C:\Windows\ssndii.exe
2014-04-02 17:10 - 2009-03-05 14:05 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\msxml2.dll
2014-04-02 17:10 - 2009-03-05 14:05 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\msxml4r.dll
2014-04-02 17:10 - 2009-03-05 14:05 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\msxml4a.dll
2014-04-02 17:10 - 2009-03-05 14:05 - 00038160 _____ (Microsoft Corporation) C:\Windows\system32\msxml2r.dll
2014-04-02 17:10 - 2009-03-05 14:05 - 00021776 _____ (Microsoft Corporation) C:\Windows\system32\msxml2a.dll
2014-04-02 17:09 - 2009-03-02 13:02 - 00026624 _____ () C:\Windows\system32\ssp4ml3.dll
2014-04-02 17:09 - 2009-03-02 13:02 - 00000361 _____ () C:\Windows\system32\ssp4ml3.smt
2014-04-02 17:09 - 2009-03-02 12:58 - 00151552 _____ (SS) C:\Windows\system32\ssp4mci.exe
2014-04-02 17:09 - 2009-03-02 12:58 - 00065536 _____ (SS) C:\Windows\system32\ssp4mci.dll
==================== One Month Modified Files and Folders =======
2014-04-13 13:58 - 2014-01-14 20:48 - 00000000 ____D () C:\Users\****
2014-04-13 13:55 - 2009-07-14 06:34 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-13 13:55 - 2009-07-14 06:34 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-13 13:52 - 2014-04-13 13:52 - 00000000 ____D () C:\Users\Gast
2014-04-13 13:52 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-13 13:51 - 2014-01-14 20:40 - 01498322 _____ () C:\Windows\WindowsUpdate.log
2014-04-13 13:47 - 2009-07-14 06:39 - 00055424 _____ () C:\Windows\setupact.log
2014-04-13 02:34 - 2014-04-13 02:34 - 00000000 ___RD () C:\Program Files\Skype
2014-04-13 02:34 - 2014-04-13 02:34 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-04-11 21:06 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-04-11 03:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-10 03:02 - 2014-01-16 02:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 03:00 - 2014-01-16 02:40 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-03 19:32 - 2010-11-20 23:48 - 00704130 _____ () C:\Windows\PFRO.log
2014-04-03 03:01 - 2014-04-03 03:01 - 00285206 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-04-03 03:00 - 2014-04-03 03:00 - 00290186 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-04-03 03:00 - 2014-04-03 03:00 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-04-02 17:10 - 2014-04-02 17:10 - 00000000 ____D () C:\Windows\Samsung
2014-04-02 17:10 - 2014-02-01 16:07 - 00000000 ____D () C:\Program Files\SamsungPrinterLiveUpdate
2014-04-02 17:08 - 2014-02-01 16:06 - 00000000 ____D () C:\Program Files\Samsung
2014-03-31 00:19 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-24 23:33 - 2014-03-10 23:03 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-03-23 20:16 - 2014-02-15 17:02 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-03-18 14:24 - 2014-01-14 21:21 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-03-18 14:24 - 2014-01-14 21:21 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-04-2014 01
Ran by Gast at 2014-04-13 14:03:03
Running from C:\Users\Gast\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
==================== Installed Programs ======================
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.12.36 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Amazon 1Button App (HKLM\...\{54AA7C11-54B7-4BD8-84B2-85873B5C7A04}) (Version: 1.0.4 - Amazon)
Amazon Browser Settings (HKLM\...\Amazon Browser Settings) (Version: 3.0 - Amazon)
ARIA Engine v1.5.0.4 (HKLM\...\ARIA Engine_is1) (Version: v1.5.0.4 - Plogue Art et Technologie, Inc)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Finale 2012 (HKLM\...\Finale 2012) (Version: 2012.c.r15.0 - MakeMusic)
Fotogalerie (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Garritan ARIA Player vAppVersion=v1.504 (HKLM\...\__ARIA_1012___is1) (Version: v1.5.0.4 - Garritan)
Garritan Instruments for Finale (HKLM\...\__ARIA_1013___is1) (Version: v1.1.2.3 - Garritan)
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
Junk Mail filter update (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
LibreOffice 4.1 Help Pack (German) (HKLM\...\{2E348DF5-1C33-4E67-B45E-8A31C534A2B9}) (Version: 4.1.5.3 - The Document Foundation)
LibreOffice 4.1.5.3 (HKLM\...\{E77773E5-944A-453F-97F3-46767AE0A253}) (Version: 4.1.5.3 - The Document Foundation)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.2 - pdfforge)
Photo Common (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Samsung Easy Printer Manager (HKLM\...\Samsung Easy Printer Manager) (Version: 1.03.72.00(20.09.2013) - Samsung Electronics Co., Ltd.)
Samsung ML-2160 Series (HKLM\...\Samsung ML-2160 Series) (Version: 1.10 (22.11.2012) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM\...\Samsung Printer Live Update) (Version: 1.01.00.04 - Samsung Electronics Co., Ltd.)
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Stellarium 0.10.2 (HKLM\...\Stellarium_is1) (Version: - )
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1018 - SUPERAntiSpyware.com)
Wartung Samsung ML-191x 252x Series (HKLM\...\Samsung ML-191x 252x Series) (Version: - Samsung Electronics CO.,LTD)
Windows Live Communications Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
==================== Loaded Modules (whitelisted) =============
2012-03-09 10:58 - 2012-03-09 10:58 - 00350072 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 10:58 - 2012-03-09 10:58 - 00056696 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-04-02 17:10 - 2009-08-14 10:10 - 00614400 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2014-03-10 23:03 - 2014-03-15 10:40 - 03642480 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-03-18 14:24 - 2014-03-18 14:24 - 16276872 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Could not list Devices. Check "winmgmt" service or repair WMI.
==================== Event log errors: =========================
Could not start eventlog service, could not read events.
Systemfehler 5 aufgetreten.
Zugriff verweigert
==================== Memory info ===========================
Percentage of memory in use: 32%
Total physical RAM: 2972.93 MB
Available physical RAM: 1996.27 MB
Total Pagefile: 5944.15 MB
Available Pagefile: 4656.24 MB
Total Virtual: 2047.88 MB
Available Virtual: 1913.73 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:377.05 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
GMER: (Anmerkung: Ich weiß nicht, ob das von Relevanz ist, aber für alle Fälle zur Info: Bei einem ersten Scanversuch brach GMER mitten im Vorgang ab mit der Bemerkung "GMER funktioniert nicht mehr". Beim zweiten Mal ging es dann.) Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-13 14:24:43
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MQ01ABD050 rev.AX001A 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\****~1\AppData\Local\Temp\pxldipoc.sys
---- System - GMER 2.1 ----
SSDT 902E8616 ZwCreateSection
SSDT 902E8620 ZwRequestWaitReplyPort
SSDT 902E861B ZwSetContextThread
SSDT 902E8625 ZwSetSecurityObject
SSDT 902E862A ZwSystemDebugControl
SSDT 902E85B7 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 82886A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 828C0212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 828C758C 4 Bytes [16, 86, 2E, 90] {PUSH SS; XCHG [ESI], CH; NOP }
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 828C78E8 4 Bytes [20, 86, 2E, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 828C792C 4 Bytes [1B, 86, 2E, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 828C79A8 4 Bytes [25, 86, 2E, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 828C79FC 4 Bytes [2A, 86, 2E, 90]
.text ...
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[788] USER32.dll!RegisterMessagePumpHook + 2F1 77508B9E 7 Bytes JMP 60BFE610 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[788] USER32.dll!IsDialogMessageW + 340 77514444 7 Bytes JMP 60BFE681 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[788] USER32.dll!GetWindowInfo 77514B5E 5 Bytes JMP 60C02366 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[788] USER32.dll!ToUnicodeEx + 71 77522223 7 Bytes JMP 60BFBD82 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateFile + 6 777D560E 4 Bytes [28, A8, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateFile + B 777D5613 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateKey + 6 777D564E 4 Bytes [68, A9, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateKey + B 777D5653 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateMutant + 6 777D568E 4 Bytes [68, AA, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateMutant + B 777D5693 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateSection + 6 777D572E 4 Bytes [A8, AA, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtCreateSection + B 777D5733 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtMapViewOfSection + B 777D5C73 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenFile + 6 777D5D1E 4 Bytes [68, A8, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenFile + B 777D5D23 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenKey + 6 777D5D4E 4 Bytes [A8, A9, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenKey + B 777D5D53 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenKeyEx + B 777D5D63 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenMutant + 6 777D5D9E 4 Bytes [28, AA, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenMutant + B 777D5DA3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenProcess + 6 777D5DCE 4 Bytes [68, AB, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenProcess + B 777D5DD3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenProcessToken + 6 777D5DDE 4 Bytes [A8, AB, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenProcessToken + B 777D5DE3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenProcessTokenEx + 6 777D5DEE 4 Bytes [68, AC, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenProcessTokenEx + B 777D5DF3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenSection + B 777D5E13 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenThread + 6 777D5E4E 4 Bytes [28, AB, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenThread + B 777D5E53 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenThreadToken + 6 777D5E5E 4 Bytes [28, AC, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenThreadToken + B 777D5E63 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenThreadTokenEx + 6 777D5E6E 4 Bytes [A8, AC, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtOpenThreadTokenEx + B 777D5E73 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtQueryAttributesFile + 6 777D5F7E 4 Bytes [A8, A8, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtQueryAttributesFile + B 777D5F83 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtQueryFullAttributesFile + B 777D6033 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtSetInformationFile + 6 777D667E 4 Bytes [28, A9, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtSetInformationFile + B 777D6683 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtSetInformationThread + B 777D66E3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtUnmapViewOfSection + 6 777D69FE 4 Bytes [28, AD, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ntdll.dll!NtUnmapViewOfSection + B 777D6A03 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] kernel32.dll!CreateProcessW 75E0204D 5 Bytes JMP 00080030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] kernel32.dll!CreateProcessA 75E02082 5 Bytes JMP 00080070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!ActivateKeyboardLayout 77508203 5 Bytes JMP 000C04F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!ScreenToClient 7750A506 7 Bytes JMP 000C0670
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!RegisterClipboardFormatA 7750C091 5 Bytes JMP 000C02F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!RegisterClipboardFormatW 7750DF8D 5 Bytes JMP 000C02B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!SetCursor 77513075 5 Bytes JMP 000C0530
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!MonitorFromWindow 77513622 7 Bytes JMP 000C0630
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!PostMessageW 7751447B 5 Bytes JMP 000C05F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!IsWindowVisible 77514D69 7 Bytes JMP 000C06B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetClientRect 775154DD 7 Bytes JMP 000C05B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!MapWindowPoints 77515CAA 5 Bytes JMP 000C0570
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetParent 77516029 7 Bytes JMP 000C06F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!EmptyClipboard 7752290C 5 Bytes JMP 000C0130
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!SetClipboardData 77522962 5 Bytes JMP 000C0170
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetClipboardData 77522BA7 5 Bytes JMP 000C0030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetClipboardFormatNameW 77525FD2 5 Bytes JMP 000C0230
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!SetClipboardViewer 77526FF6 5 Bytes JMP 000C04B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetClipboardFormatNameA 7752700A 5 Bytes JMP 000C0270
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!ChangeClipboardChain 7753147C 5 Bytes JMP 000C0430
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetTopWindow 775324D9 7 Bytes JMP 000C0730
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!CloseClipboard 7753446C 5 Bytes JMP 000C00B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!OpenClipboard 7753447E 5 Bytes JMP 000C0070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!IsClipboardFormatAvailable 775344FF 5 Bytes JMP 000C00F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetClipboardSequenceNumber 77534513 5 Bytes JMP 000C0330
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetClipboardOwner 77534525 5 Bytes JMP 000C0370
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!CountClipboardFormats 7753470A 5 Bytes JMP 000C01F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!EnumClipboardFormats 775347EC 5 Bytes JMP 000C01B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetOpenClipboardWindow 7753480B 5 Bytes JMP 000C03F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!SetCursorPos 7754C1B0 5 Bytes JMP 000C0770
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetClipboardViewer 77564AF7 5 Bytes JMP 000C0470
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] user32.DLL!GetPriorityClipboardFormat 77564BF9 5 Bytes JMP 000C03B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!DeleteObject 77975F14 5 Bytes JMP 001801B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SelectObject 77976640 5 Bytes JMP 001805F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetTextColor 77976906 5 Bytes JMP 00180A30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetBkMode 779769B1 5 Bytes JMP 001808F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!DeleteDC 77976EAA 5 Bytes JMP 00180170
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetDeviceCaps 77976F7F 5 Bytes JMP 001803B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!ExtSelectClipRgn 77977114 5 Bytes JMP 001802F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SelectClipRgn 77977242 5 Bytes JMP 001805B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetStretchBltMode 77977705 5 Bytes JMP 001806B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetCurrentObject 77977917 5 Bytes JMP 00180370
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextMetricsW 77977B8F 5 Bytes JMP 00180E30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextAlign 77977DAF 5 Bytes JMP 00180D70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!IntersectClipRect 77977DFE 5 Bytes JMP 001803F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!ExtTextOutW 77978192 5 Bytes JMP 00180970
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetTextAlign 7797828E 5 Bytes JMP 001809F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetClipBox 77978525 5 Bytes JMP 00180330
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!MoveToEx 77978C21 5 Bytes JMP 00180470
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!StretchDIBits 7797A53E 5 Bytes JMP 00180770
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!RestoreDC 7797A67B 5 Bytes JMP 00180530
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SaveDC 7797A74B 5 Bytes JMP 00180570
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextExtentPoint32W 7797B4B5 5 Bytes JMP 00180670
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextFaceW 7797B73A 2 Bytes JMP 00180D30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextFaceW + 3 7797B73D 2 Bytes [80, 88]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetFontData 7797BCC4 5 Bytes JMP 00180C70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetWorldTransform 7797C90A 5 Bytes JMP 001806F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!CreateDCA 7797CCA9 5 Bytes JMP 001800B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!CreateDCW 7797CF79 5 Bytes JMP 001800F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!CreateICW 7797CFD0 5 Bytes JMP 00180130
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextMetricsA 7797D0F2 5 Bytes JMP 00180DF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!Rectangle 7797F1FF 5 Bytes JMP 001809B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!LineTo 7797F59B 5 Bytes JMP 00180430
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetICMMode 7797FAA4 5 Bytes JMP 00180DB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!ExtTextOutA 77980D20 5 Bytes JMP 00180930
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextExtentPoint32A 7798117F 5 Bytes JMP 00180630
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!ExtEscape 77982D49 5 Bytes JMP 001802B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!Escape 77983400 5 Bytes JMP 00180270
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!ResetDCW 77983A9B 5 Bytes JMP 00180AB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!EndPage 779840DA 5 Bytes JMP 00180230
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetPolyFillMode 779867E1 5 Bytes JMP 00180B30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SetMiterLimit 7798699D 5 Bytes JMP 00180B70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetTextFaceA 77990D22 5 Bytes JMP 00180CF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!GetGlyphOutlineW 7799C2DA 5 Bytes JMP 00180CB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!CreateScalableFontResourceW 7799E937 5 Bytes JMP 00180BB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!AddFontResourceW 7799ED33 5 Bytes JMP 00180BF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!RemoveFontResourceW 7799F229 5 Bytes JMP 00180C30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!AbortDoc 779A4E29 5 Bytes JMP 00180030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!EndDoc 779A5270 5 Bytes JMP 001801F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!StartPage 779A535B 5 Bytes JMP 00180730
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!StartDocW 779A5D76 5 Bytes JMP 001807F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!BeginPath 779A651D 5 Bytes JMP 00180830
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!SelectClipPath 779A6574 5 Bytes JMP 00180AF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!CloseFigure 779A65CF 5 Bytes JMP 00180070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!EndPath 779A6626 5 Bytes JMP 00180A70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!StrokePath 779A6859 5 Bytes JMP 001807B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!FillPath 779A68E6 5 Bytes JMP 00180870
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!PolylineTo 779A6D54 5 Bytes JMP 001804F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!PolyBezierTo 779A6DE5 5 Bytes JMP 001804B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] GDI32.dll!PolyDraw 779A6E97 5 Bytes JMP 001808B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ole32.dll!OleSetClipboard 764D0045 5 Bytes JMP 002A0030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ole32.dll!OleIsCurrentClipboard 764D36B2 5 Bytes JMP 002A0070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe[2252] ole32.dll!OleGetClipboard 764FFDCD 5 Bytes JMP 002A00B0
.text C:\Program Files\Mozilla Firefox\firefox.exe[3584] ntdll.dll!LdrGetProcedureAddress + 26 777F22A9 7 Bytes JMP 6B4B1FD9 C:\Program Files\Mozilla Firefox\mozglue.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3584] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D 75E494E6 7 Bytes JMP 613040E1 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3584] kernel32.dll!QueryPerformanceCounter + 13 75E4C4E5 7 Bytes JMP 61304104 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3584] kernel32.dll!LoadAppInitDlls + 355 75E4F5A6 7 Bytes JMP 609D3255 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3584] GDI32.dll!GetViewportOrgEx + 26C 7797884B 7 Bytes JMP 61304062 C:\Program Files\Mozilla Firefox\xul.dll
---- EOF - GMER 2.1 ----
 |
| Themen zu Win7: BKA-Trojaner? |
| admin-passwort, adobe, antivir, antivirus, avg, avira, browser, computer, converter, cursor, error, explorer, firefox, flash player, frage, funktioniert nicht mehr, gmx.net, helper, iexplore.exe, mozilla, newtab, ntdll.dll, registry, security, services.exe, superantispyware, svchost.exe, system, temp, winlogon.exe |
Baum-Darstellung