![]() |
|
Log-Analyse und Auswertung: Win 7/ Rootkit lässt sich nicht entfernen.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
|
![]() | #1 |
| ![]() Win 7/ Rootkit lässt sich nicht entfernen. Hallo, bin echt am verzweifelt ![]() Ich habe Windows schon mehrfach Neu Installiert, Festplatten Formatiert und immer wieder das selbe. Gruppen rechte für den Admin werden gesperrt usw. und komische Automatisch Installierte Datein im Windows verzeichnis. Das ganz ist mir aufgefallen, weil ich bei mein Provider ein Netblock bekommen habe. Ich habe schon zich Viren Tools und Root Scanner ausprobiert, ich kann das Infecte Betriebssystem einfach nicht mehr Normal Steuern und weiß zu dem nicht was mit mein Rechner angestellt wird, scheinbar schon ordentlich mist, sonst hätte ich durch mein Provider nicht ein Netblock. Ich hoffe mir kann hier jemand weiter helfen. Ich Poste mal die Logs. defogger - log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 00:34 on 04/07/2014 (Neu) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:03-07-2014 Ran by Neu (administrator) on Neu-PC on 04-07-2014 00:36:18 Running from C:\Users\Neu\Desktop Platform: Microsoft Windows 7 Enterprise (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (PortableApps.com) C:\Users\Neu\Desktop\FirefoxPortable\FirefoxPortable.exe (Mozilla Corporation) C:\Users\Neu\Desktop\FirefoxPortable\App\Firefox\firefox.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe (Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\EMMSN.exe (Telefónica I+D) C:\Program Files\o2\Nori\Nori.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe () C:\Users\Neu\Desktop\Defogger.exe ==================== Registry (Whitelisted) ================== ==================== Internet (Whitelisted) ==================== Tcpip\..\Interfaces\{D748268F-6327-4697-*-*}: [NameServer]193.*.*.* 193.*.*.* FireFox: ======== ========================== Services (Whitelisted) ================= R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-11-11] (Telefónica I+D) ==================== Drivers (Whitelisted) ==================== S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-04 01:18 - 2014-07-04 01:18 - 00008192 __RSH () C:\BOOTSECT.BAK 2014-07-04 01:18 - 2009-07-14 03:38 - 00383562 __RSH () C:\bootmgr 2014-07-04 00:36 - 2014-07-04 00:36 - 00002100 _____ () C:\Users\Neu\Desktop\FRST.txt 2014-07-04 00:36 - 2014-07-04 00:36 - 00000000 ____D () C:\FRST 2014-07-04 00:35 - 2014-07-04 00:35 - 01073664 _____ (Farbar) C:\Users\Neu\Desktop\FRST.exe 2014-07-04 00:34 - 2014-07-04 00:34 - 00050477 _____ () C:\Users\Neu\Desktop\Defogger.exe 2014-07-04 00:34 - 2014-07-04 00:34 - 00000468 _____ () C:\Users\Neu\Desktop\defogger_disable.log 2014-07-04 00:34 - 2014-07-04 00:34 - 00000000 _____ () C:\Users\Neu\defogger_reenable 2014-07-04 00:28 - 2014-07-04 00:28 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf 2014-07-04 00:27 - 2014-07-04 00:27 - 00002062 _____ () C:\Users\Public\Desktop\Mobile Connection Manager.lnk 2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Windows\massfilter 2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Telefónica 2014-07-04 00:27 - 2010-02-22 18:25 - 00014336 _____ (ZTE) C:\Windows\system32\Drivers\ZTEusbccid.sys 2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbser6k.sys 2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbnmeaext2.sys 2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbnmea.sys 2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbmdm6k.sys 2014-07-04 00:27 - 2010-02-10 17:50 - 00186368 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbnet.sys 2014-07-04 00:27 - 2009-12-28 15:52 - 00010240 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\massfilter.sys 2014-07-04 00:27 - 2009-02-03 16:56 - 00009728 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\massfilter_hs.sys 2014-07-04 00:26 - 2014-07-04 00:31 - 00004520 _____ () C:\Windows\WindowsUpdate.log 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Mozilla 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Local\Mozilla 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\o2 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Program Files\o2 2014-07-04 00:25 - 2014-07-04 00:25 - 00001413 _____ () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-04 00:25 - 2014-07-04 00:25 - 00000000 ____D () C:\Users\Neu\Desktop\FirefoxPortable 2014-07-04 00:24 - 2014-07-04 00:34 - 00000000 ____D () C:\Users\Neu 2014-07-04 00:24 - 2014-07-04 00:24 - 00000020 ___SH () C:\Users\Neu\ntuser.ini 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Startmenü 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Netzwerkumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Druckumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Local\Verlauf 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Startmenü 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Druckumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Startmenü 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Dokumente 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 __SHD () C:\Recovery 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 ____D () C:\Users\Neu\AppData\Local\VirtualStore 2014-07-04 00:24 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-07-04 00:24 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\system32\atiicdxx.dat 2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\ativpsrm.bin 2014-07-04 00:19 - 2014-07-04 00:19 - 00000000 ____D () C:\Windows\CSC ==================== One Month Modified Files and Folders ======= 2014-07-04 01:18 - 2014-07-04 01:18 - 00008192 __RSH () C:\BOOTSECT.BAK 2014-07-04 01:18 - 2009-07-14 06:57 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG 2014-07-04 01:18 - 2009-07-14 06:52 - 00028672 _____ () C:\Windows\system32\config\BCD-Template 2014-07-04 00:36 - 2014-07-04 00:36 - 00002100 _____ () C:\Users\Neu\Desktop\FRST.txt 2014-07-04 00:36 - 2014-07-04 00:36 - 00000000 ____D () C:\FRST 2014-07-04 00:35 - 2014-07-04 00:35 - 01073664 _____ (Farbar) C:\Users\Neu\Desktop\FRST.exe 2014-07-04 00:34 - 2014-07-04 00:34 - 00050477 _____ () C:\Users\Neu\Desktop\Defogger.exe 2014-07-04 00:34 - 2014-07-04 00:34 - 00000468 _____ () C:\Users\Neu\Desktop\defogger_disable.log 2014-07-04 00:34 - 2014-07-04 00:34 - 00000000 _____ () C:\Users\Neu\defogger_reenable 2014-07-04 00:34 - 2014-07-04 00:24 - 00000000 ____D () C:\Users\Neu 2014-07-04 00:31 - 2014-07-04 00:26 - 00004520 _____ () C:\Windows\WindowsUpdate.log 2014-07-04 00:28 - 2014-07-04 00:28 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf 2014-07-04 00:28 - 2010-09-14 20:52 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-04 00:28 - 2009-07-14 06:39 - 00022175 _____ () C:\Windows\setupact.log 2014-07-04 00:27 - 2014-07-04 00:27 - 00002062 _____ () C:\Users\Public\Desktop\Mobile Connection Manager.lnk 2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Windows\massfilter 2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Telefónica 2014-07-04 00:27 - 2009-07-14 06:34 - 00009984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-04 00:27 - 2009-07-14 06:34 - 00009984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Mozilla 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Local\Mozilla 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\o2 2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Program Files\o2 2014-07-04 00:26 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\system32\restore 2014-07-04 00:25 - 2014-07-04 00:25 - 00001413 _____ () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-04 00:25 - 2014-07-04 00:25 - 00000000 ____D () C:\Users\Neu\Desktop\FirefoxPortable 2014-07-04 00:24 - 2014-07-04 00:24 - 00000020 ___SH () C:\Users\Neu\ntuser.ini 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Startmenü 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Netzwerkumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Druckumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Local\Verlauf 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Startmenü 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Druckumgebung 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Startmenü 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Dokumente 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 __SHD () C:\Recovery 2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 ____D () C:\Users\Neu\AppData\Local\VirtualStore 2014-07-04 00:24 - 2010-09-14 21:40 - 00000000 ____D () C:\Windows\Panther 2014-07-04 00:24 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default 2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\Recovery 2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Windows NT 2014-07-04 00:21 - 2010-09-14 20:42 - 00003540 _____ () C:\Windows\TSSysprep.log 2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\system32\atiicdxx.dat 2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\ativpsrm.bin 2014-07-04 00:19 - 2014-07-04 00:19 - 00000000 ____D () C:\Windows\CSC 2014-07-04 00:19 - 2009-07-14 06:34 - 00002790 _____ () C:\Windows\DtcInstall.log Some content of TEMP: ==================== C:\Users\Neu\AppData\Local\Temp\card_setup.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2010-09-14 20:41 ==================== End Of Log ============================ Addition -log FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:03-07-2014 Ran by Neu at 2014-07-04 00:36:54 Running from C:\Users\Neu\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Mobile Connection Manager (HKLM\...\o2DE) (Version: - Mobile Connection Manager) ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.25_TME - ZTE Corporation) ==================== Restore Points ========================= 03-07-2014 22:26:51 Instalado ZTE Drivers v1.2059.0.11 ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= ==================== Loaded Modules (whitelisted) ============= 2014-07-04 00:26 - 2014-07-04 00:26 - 00029696 _____ () C:\Users\Neu\AppData\Local\Temp\nsgCED4.tmp\registry.dll 2014-07-04 00:26 - 2014-07-04 00:26 - 00008704 _____ () C:\Users\Neu\AppData\Local\Temp\nsgCED4.tmp\newadvsplash.dll 2014-07-04 00:26 - 2014-07-04 00:26 - 00011264 _____ () C:\Users\Neu\AppData\Local\Temp\nsgCED4.tmp\System.dll 2014-06-06 06:38 - 2014-06-06 06:38 - 03852912 _____ () C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\mozjs.dll 2010-11-11 18:07 - 2010-11-11 18:07 - 00125304 _____ () C:\Program Files\o2\Mobile Connection Manager\AgendaLib.dll 2010-11-11 18:07 - 2010-11-11 18:07 - 00508760 _____ () C:\Program Files\o2\Mobile Connection Manager\sqlite3.dll 2009-07-13 23:03 - 2009-07-14 03:15 - 00364544 _____ () C:\Windows\system32\msjetoledb40.dll 2010-11-11 17:52 - 2010-11-11 17:52 - 00018864 _____ () C:\Program Files\o2\Mobile Connection Manager\langs\de_DE_md.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00201136 _____ () C:\Program Files\o2\Nori\legplgs\plgalc.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00191920 _____ () C:\Program Files\o2\Nori\legplgs\plgati.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00240048 _____ () C:\Program Files\o2\Nori\legplgs\plghwi.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00190384 _____ () C:\Program Files\o2\Nori\legplgs\plgice.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00293296 _____ () C:\Program Files\o2\Nori\legplgs\plgnvt.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00193968 _____ () C:\Program Files\o2\Nori\legplgs\plgopt.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00193456 _____ () C:\Program Files\o2\Nori\legplgs\plgser.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00342448 _____ () C:\Program Files\o2\Nori\legplgs\plgsie.dll 2010-11-11 18:00 - 2010-11-11 18:00 - 00192944 _____ () C:\Program Files\o2\Nori\legplgs\plgzte.dll 2014-07-04 00:34 - 2014-07-04 00:34 - 00050477 _____ () C:\Users\Neu\Desktop\Defogger.exe ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/04/2014 00:26:50 AM) (Source: VSS) (EventID: 8194) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert . Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess. Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {aa6d7fea-93d2-4e09-bafe-e0cd4e11c089} System errors: ============= Error: (07/04/2014 00:28:38 AM) (Source: Server) (EventID: 2505) (User: ) Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{D748268F-6327-4697-95C8-EEB9982DAA0B} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error: (09/14/2010 09:22:28 PM) (Source: DCOM) (EventID: 10010) (User: ) Description: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Microsoft Office Sessions: ========================= Error: (07/04/2014 00:26:50 AM) (Source: VSS) (EventID: 8194) (User: ) Description: 0x80070005, Zugriff verweigert Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {aa6d7fea-93d2-4e09-bafe-e0cd4e11c089} ==================== Memory info =========================== Percentage of memory in use: 47% Total physical RAM: 1790.49 MB Available physical RAM: 944.89 MB Total Pagefile: 3580.98 MB Available Pagefile: 2624.65 MB Total Virtual: 2047.88 MB Available Virtual: 1889.46 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:335.34 GB) (Free:325.52 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: () (Fixed) (Total:335.34 GB) (Free:335.13 GB) NTFS Drive e: (bie786910g) (CDROM) (Total:2.64 GB) (Free:0 GB) CDFS Drive f: () (Removable) (Total:0.03 GB) (Free:0.03 GB) FAT ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 335 GB) (Disk ID: 6C96BF96) Partition 1: (Not Active) - (Size=335 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 335 GB) (Disk ID: BD4F7A07) Partition 1: (Active) - (Size=335 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (Size: 29 MB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ gmer - log GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-07-04 00:51:25 Windows 6.1.7600 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-7 ST3360320AS rev.3.AAM 335,35GB Running: i97e8zep.exe; Driver: C:\Users\Neu\AppData\Local\Temp\uwldqpow.sys ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82851599 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82875F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8CA24000, 0x227A14, 0xE8000020] ---- User code sections - GMER 2.1 ---- .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtCreateFile 77D94A30 5 Bytes JMP 6620B8D0 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtFlushBuffersFile 77D94DC0 5 Bytes JMP 66207B07 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtQueryFullAttributesFile 77D95450 5 Bytes JMP 66207820 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtReadFile 77D95720 5 Bytes JMP 66207A00 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtReadFileScatter 77D95730 5 Bytes JMP 66A5CCC0 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtWriteFile 77D95ED0 5 Bytes JMP 6620BFE0 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtWriteFileGather 77D95EE0 5 Bytes JMP 66A5CC6F C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!LdrLoadDll 77DAF625 5 Bytes JMP 69901EAE C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\mozglue.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] kernel32.dll!K32GetDeviceDriverBaseNameW + 16F 7691C0CF 7 Bytes JMP 66A29E65 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] kernel32.dll!CloseHandle + 38 7692060F 7 Bytes JMP 66A29E88 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] kernel32.dll!GetExitCodeProcess + 2C 7692315D 7 Bytes JMP 66208236 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] USER32.dll!GetWindowInfo 761B6A82 5 Bytes JMP 66937585 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll .text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] GDI32.dll!GetViewportOrgEx + 21C 769B85EB 7 Bytes JMP 66A29DE6 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll ---- Devices - GMER 2.1 ---- AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 22 ---- EOF - GMER 2.1 ---- Ich hoffe echt mir kann Hier jemand weiterhelfen und bin über jede Hilfe dankbar. Zur Info, dass Windows wurde gerade erst Neu Installiert. Gruß Geändert von mmkai (04.07.2014 um 00:19 Uhr) |
Themen zu Win 7/ Rootkit lässt sich nicht entfernen. |
.dll, administrator, cdrom, defender, download, entfernen, explorer, explorer.exe, fehler, festplatte, gesperrt, harddisk, installation, microsoft, mozilla, neu, registry, rootkit, scan, security, services.exe, svchost.exe, viren, windows, winlogon.exe |