![]() |
|
Log-Analyse und Auswertung: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 Guten Tag zusammen, Avast premium hat mir beim heutigen Suchlauf folgenden Trojaner gemeldet Win32:BProtect-D [Trj] Avast kann ihn nicht in den Container verschieben. Ich hätte dieses Ding gerne los und wäre froh wenn ich Hilfestellung bekomme. gemäß eurer Anleitung habe ich mein System schonmal gescannt Systemscan mit fsrt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-09-2014 01 Ran by muck (administrator) on MUCK-PC on 23-09-2014 12:42:49 Running from C:\Users\muck\Desktop\scansoftware Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe (ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe (RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe () C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (STRATO) C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe (X10) C:\Program Files\Common Files\X10\Common\X10nets.exe () C:\Program Files\002\yewimmxqbs32.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe () C:\Windows\tsnp2uvc.exe (CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink Corp.) C:\Program Files\CyberLink\YouCam\YouCamTray.exe (MyHeritage) C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe () C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe (ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe (ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe (Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe (RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Stardock) C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation) C:\Windows\System32\sdclt.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor) HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] () HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink) HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [YouCam Mirror Tray icon] => C:\Program Files\CyberLink\YouCam\YouCamTray.exe [167008 2009-09-28] (CyberLink Corp.) HKLM\...\Run: [fspuip] => "\FSP\fspuip.exe" HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-30] (Adobe Systems Incorporated) HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [663552 2007-03-12] (Brother Industries, Ltd.) HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM\...\Run: [Family Tree Builder Update] => C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2532352 2013-08-04] (MyHeritage) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4085896 2014-08-05] (AVAST Software) HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [65536 2007-01-26] (Brother Industries, Ltd.) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) HKLM\...\Run: [DSL Soforthilfe] => C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] () HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [296520 2014-08-03] (RealNetworks, Inc.) HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Google Update] => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-01] (Google Inc.) HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Akamai NetSession Interface] => C:\Users\muck\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.) HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [100200 2014-01-15] (Siber Systems) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.) Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\muck\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock) ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=prc265 HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q= HKLM\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592 HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q= SearchScopes: HKLM - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir= SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms} SearchScopes: HKLM - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms} SearchScopes: HKCU - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com SearchScopes: HKCU - {05836D6B-3A4B-487A-82D3-2001E0D2828F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir= SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&affID=120519&babsrc=SP_ss&mntrId=E23B1C4BD630514D SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKCU - {69535C9E-55B0-418C-A041-6610346008ED} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=kw&q={searchTerms}&locale=&apn_ptnrs=^T8&apn_dtid=^zzz001^YY^DE&apn_uid=caedf34a-2c5c-4ca1-8d60-14a58ef0d500&apn_sauid=B3E2833F-1148-4DC5-9449-8AA579D3417A SearchScopes: HKCU - {87C7DAB5-00A2-49E3-8892-ADF265F0308A} URL = hxxp://www.google.de/search?q={searchTerms} SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms} SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms} SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms} SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6OySRaoenk&i=26 SearchScopes: HKCU - {F33C6390-D1E5-45D5-9694-672A7C1B29BE} URL = hxxp://ws.infospace.com/gamers_brw/ws/redir?_iceUrl=true&user_id=%userid&tool_id=%toolid&qkw={searchTerms} BHO: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) BHO: avast! EasyPass Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software) Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.5.1 -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin: @spoon.net/Spoon Plugin 3.33 -> C:\Program Files\Spoon\3.33.6.270\npMozillaSpoonPlugin.dll No File FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2012-03-23] FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2012-03-23] FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2012-03-23] FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} [2012-04-19] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-15] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-09-05] FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox FF HKLM\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-08-03] Chrome: ======= CHR CustomProfile: C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23] CHR Extension: (avast! Online Security) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-29] CHR Extension: (RealPlayer Downloader) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-08-03] CHR Extension: (Google Wallet) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07] CHR HKLM\...\Chrome\Extension: [dkinklhnkmkhkhofcnapakaoehijaoih] - C:\Program Files\OnlineHD.TV\onhd11.crx [] CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-08-05] CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10] CHR HKLM\...\Chrome\Extension: [jifflliplgeajjdhmkcfnngfpgbjonjg] - C:\Program Files\Perion\NewTab\newTab.crx [2012-11-01] CHR HKLM\...\Chrome\Extension: [kpkbnefaikfaeadgidhpoanckoiaheli] - C:\Program Files\HDvidCodec.com\HDvidCodec10.crx [2013-04-17] CHR HKLM\...\Chrome\Extension: [lbbbdmbjkgojacipgefbifkiebpcdjhn] - C:\Program Files\Movie2KDownloader.com\m2kDownloader10.crx [2013-04-17] CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx [2012-11-01] CHR StartMenuInternet: Google Chrome - C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-08-05] (AVAST Software) R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [106488 2014-08-05] (AVAST Software) R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] () R2 RealPlayer Cloud Service; c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-08-03] (RealNetworks, Inc.) R2 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-26] () [File not signed] R2 STRATO HiDrive Service; C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-07-05] (STRATO) [File not signed] S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed] R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed] R2 yewimmxqbs32; C:\Program Files\002\yewimmxqbs32.exe [541696 2014-04-30] () [File not signed] S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-05] () R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-08-05] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-05] (AVAST Software) R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [270752 2014-08-05] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-08-05] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-05] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-05] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-05] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-08-05] (AVAST Software) R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-05] () S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA) R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.) S3 optousb; C:\Windows\System32\DRIVERS\optousb.sys [18432 2009-08-26] (OPTO ELECTRONICS CO.,LTD.) S3 optovcm; C:\Windows\System32\DRIVERS\optovcm.sys [26368 2009-08-26] (OPTO ELECTRONICS CO.,LTD.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2011-09-10] (Duplex Secure Ltd.) R3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [184192 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr)) R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2011-07-05] (The OpenVPN Project) R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.) R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.) S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X] S3 taphss6; system32\DRIVERS\taphss6.sys [X] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM 2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST 2014-09-23 12:33 - 2014-09-23 12:34 - 00000020 _____ () C:\Users\muck\defogger_reenable 2014-09-23 12:17 - 2014-09-23 12:42 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware 2014-08-28 21:01 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 21:01 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2020-10-02 21:05 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2020-10-02 21:03 - 2011-09-05 12:24 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM 2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST 2014-09-23 12:42 - 2014-09-23 12:17 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware 2014-09-23 12:40 - 2011-09-06 15:21 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-23 12:39 - 2013-07-19 21:42 - 00000000 ___RD () C:\Users\muck\Dropbox 2014-09-23 12:39 - 2013-07-19 21:39 - 00000000 ____D () C:\Users\muck\AppData\Roaming\Dropbox 2014-09-23 12:37 - 2011-09-06 15:21 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-23 12:35 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-23 12:35 - 2009-07-14 06:39 - 00101574 _____ () C:\Windows\setupact.log 2014-09-23 12:34 - 2014-09-23 12:33 - 00000020 _____ () C:\Users\muck\defogger_reenable 2014-09-23 12:34 - 2011-09-04 18:48 - 01706085 _____ () C:\Windows\WindowsUpdate.log 2014-09-23 12:33 - 2012-03-31 18:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-23 12:33 - 2011-09-04 18:49 - 00000000 ____D () C:\Users\muck 2014-09-23 11:56 - 2011-11-01 10:37 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000UA.job 2014-09-23 11:17 - 2010-12-30 10:18 - 00000000 ____D () C:\Users\muck\Downloads\programme 2014-09-23 09:51 - 2014-04-30 11:24 - 00000000 ____D () C:\temp 2014-09-23 09:51 - 2011-11-14 19:38 - 00000000 ____D () C:\Program Files\ScanIT-Client 2014-09-23 07:33 - 2012-03-31 18:13 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-23 07:33 - 2011-10-05 19:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-23 06:40 - 2013-04-24 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-30 23:03 - 2010-01-05 13:48 - 00000000 ____D () C:\ProgramData\Temp 2014-08-30 22:37 - 2011-12-27 22:15 - 00007607 _____ () C:\Users\muck\AppData\Local\Resmon.ResmonCfg 2014-08-30 20:56 - 2011-11-01 10:37 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000Core.job 2014-08-30 20:42 - 2009-07-14 06:33 - 03127952 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-25 20:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-08-25 06:53 - 2010-01-05 11:57 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-08-24 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-08-24 19:33 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries 2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s Some content of TEMP: ==================== C:\Users\muck\AppData\Local\Temp\99310uninstall.exe C:\Users\muck\AppData\Local\Temp\AskSLib.dll C:\Users\muck\AppData\Local\Temp\BackupSetup.exe C:\Users\muck\AppData\Local\Temp\Cloud_Backup_Setup_euro.exe C:\Users\muck\AppData\Local\Temp\distro-amzn-adknowledge-rs.exe C:\Users\muck\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv3wdps.dll C:\Users\muck\AppData\Local\Temp\frnd2wtd.dll C:\Users\muck\AppData\Local\Temp\f_kz3t_c.dll C:\Users\muck\AppData\Local\Temp\htmlayout.dll C:\Users\muck\AppData\Local\Temp\InstallAX.exe C:\Users\muck\AppData\Local\Temp\installhelper.dll C:\Users\muck\AppData\Local\Temp\InstallPlugin.exe C:\Users\muck\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Users\muck\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\muck\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe C:\Users\muck\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe C:\Users\muck\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe C:\Users\muck\AppData\Local\Temp\mediaimpression_1.5.42.419_1.5.42.1202_update_all.exe C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083336.exe C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083344.exe C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7118_Size_36943976.exe C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7121_Size_36936376.exe C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7128_Size_37008752.exe C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader(1).exe C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader.exe C:\Users\muck\AppData\Local\Temp\nitro_reader3.exe C:\Users\muck\AppData\Local\Temp\nsgAE6C.exe C:\Users\muck\AppData\Local\Temp\nsiD2F.exe C:\Users\muck\AppData\Local\Temp\nsmFD22.tmp.exe C:\Users\muck\AppData\Local\Temp\nss3FA.exe C:\Users\muck\AppData\Local\Temp\nss6447.exe C:\Users\muck\AppData\Local\Temp\nsx5DB1.exe C:\Users\muck\AppData\Local\Temp\setup.exe C:\Users\muck\AppData\Local\Temp\SetupDataMngr_Searchqu.exe C:\Users\muck\AppData\Local\Temp\Sqlite3.dll C:\Users\muck\AppData\Local\Temp\SRAssetsHelper.dll C:\Users\muck\AppData\Local\Temp\stubhelper.dll C:\Users\muck\AppData\Local\Temp\uninst1.exe C:\Users\muck\AppData\Local\Temp\uninstall8547996.exe C:\Users\muck\AppData\Local\Temp\vcredist_x86.exe C:\Users\muck\AppData\Local\Temp\YontooSetup-S.exe C:\Users\muck\AppData\Local\Temp\_is4C6A.exe C:\Users\muck\AppData\Local\Temp\_is52E.exe C:\Users\muck\AppData\Local\Temp\_isD195.exe C:\Users\muck\AppData\Local\Temp\_TinDel.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-25 20:26 ==================== End Of Log ============================ Gmerlog: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-09-23 14:49:45 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0003 465,76GB Running: tusxwiur.exe; Driver: C:\Users\muck\AppData\Local\Temp\pwldypoc.sys ---- System - GMER 2.1 ---- SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0x9112DBA6] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0x9112E684] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0x9113A6F8] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0x9113A744] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0x9113A8DE] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0x9113A666] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateSection [0x8B79EDF0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0x9113A6AE] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThread [0x8B79F080] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThreadEx [0x8B79F16A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0x9113A898] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0x9112F472] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0x9112DC0C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDuplicateObject [0x91132C68] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwLoadDriver [0x9112D7F8] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwMapViewOfSection [0x8B79EED0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0x9112DC72] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0x9113305E] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0x9112FF5A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0x9113A722] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0x9113A766] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0x9113A902] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0x9113A68C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0x91132560] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0x9113A816] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0x9113A6D6] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0x9113294C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0x9113A8BC] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0x8B79EC6E] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0x9112FDCE] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThreadEx [0x9112FADC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0x9112DCD8] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0x9112DD3E] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwSetContextThread [0x8B79EFCC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0x9112D892] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0x9112DA64] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0x9112D9F2] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0x9112F63C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0x9112F79E] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0x9112DAEC] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwTerminateProcess [0x8B79ED3C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0x9112F2CC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0x9112DDA4] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwWriteVirtualMemory [0x8B79EBA0] ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83084A15 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 830BE212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text ntkrnlpa.exe!KeRemoveQueueEx + 10CB 830C5460 4 Bytes [A6, DB, 12, 91] {CMPSB ; FIST DWORD [EDX]; XCHG ECX, EAX} .text ntkrnlpa.exe!KeRemoveQueueEx + 1153 830C54E8 4 Bytes [84, E6, 12, 91] .text ntkrnlpa.exe!KeRemoveQueueEx + 11A7 830C553C 8 Bytes [F8, A6, 13, 91, 44, A7, 13, ...] {CLC ; CMPSB ; ADC EDX, [ECX-0x6eec58bc]} .text ntkrnlpa.exe!KeRemoveQueueEx + 11B3 830C5548 4 Bytes [DE, A8, 13, 91] .text ntkrnlpa.exe!KeRemoveQueueEx + 11CF 830C5564 4 Bytes [66, A6, 13, 91] .text ... PAGE ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 108 832804EF 4 Bytes CALL 91130641 \SystemRoot\system32\drivers\aswSnx.sys PAGE ntkrnlpa.exe!ZwAlpcSendWaitReceivePort + 122 8329A357 4 Bytes CALL 91130657 \SystemRoot\system32\drivers\aswSnx.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe[148] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\csrss.exe[488] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\wininit.exe[556] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\csrss.exe[576] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\services.exe[612] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text ... .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP } .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\System32\spoolsv.exe[1636] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\svchost.exe[1676] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe[1696] KERNEL32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP } .text C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe[1860] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe[1864] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe[2076] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2100] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text ... .text C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP } .text C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\Dwm.exe[3256] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\Explorer.EXE[3284] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3460] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\wbem\wmiprvse.exe[3484] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text ... .text C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4} .text C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4416] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4456] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe[4464] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4} .text C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4500] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\svchost.exe[4752] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\wbem\unsecapp.exe[4812] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text C:\Windows\system32\wbem\wmiprvse.exe[4888] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62] .text ... ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA2 0x9B 0x87 0xD2 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA2 0x9B 0x87 0xD2 ... Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\muck\Downloads\programme\Adobe_Creative_Suite\x00a05_Master_Collection-AkamaiDLM.exe 1 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- Vielen Dank für Eure Hilfe |
Themen zu Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 |
administrator, antivirus, avast, dll, dsl, fehlercode 0x81000006, fehlercode 22, fehlercode 43, firewall, flash player, helper, home, newtab, realtek, registry, security, services.exe, system, this device cannot start. (code10), this device is disabled. (code 22), trojaner, vcredist, windows, winlogon.exe |