Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Alt 23.09.2014, 14:10   #1
doob
 
Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard

Trojaner an Board: Win32:BProtect-D [Trj] System:Win7



Guten Tag zusammen,

Avast premium hat mir beim heutigen Suchlauf folgenden Trojaner gemeldet Win32:BProtect-D [Trj]
Avast kann ihn nicht in den Container verschieben.

Ich hätte dieses Ding gerne los und wäre froh wenn ich Hilfestellung bekomme.

gemäß eurer Anleitung habe ich mein System schonmal gescannt


Systemscan mit fsrt:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-09-2014 01
Ran by muck (administrator) on MUCK-PC on 23-09-2014 12:42:49
Running from C:\Users\muck\Desktop\scansoftware
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(STRATO) C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
() C:\Program Files\002\yewimmxqbs32.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\tsnp2uvc.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\YouCam\YouCamTray.exe
(MyHeritage) C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
() C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Stardock) C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [YouCam Mirror Tray icon] => C:\Program Files\CyberLink\YouCam\YouCamTray.exe [167008 2009-09-28] (CyberLink Corp.)
HKLM\...\Run: [fspuip] => "\FSP\fspuip.exe"
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [663552 2007-03-12] (Brother Industries, Ltd.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Family Tree Builder Update] => C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2532352 2013-08-04] (MyHeritage)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4085896 2014-08-05] (AVAST Software)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [65536 2007-01-26] (Brother Industries, Ltd.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [DSL Soforthilfe] => C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] ()
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [296520 2014-08-03] (RealNetworks, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Google Update] => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-01] (Google Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Akamai NetSession Interface] => C:\Users\muck\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [100200 2014-01-15] (Siber Systems)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\muck\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=prc265
HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
SearchScopes: HKLM - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKLM - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - {05836D6B-3A4B-487A-82D3-2001E0D2828F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&affID=120519&babsrc=SP_ss&mntrId=E23B1C4BD630514D
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKCU - {69535C9E-55B0-418C-A041-6610346008ED} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=kw&q={searchTerms}&locale=&apn_ptnrs=^T8&apn_dtid=^zzz001^YY^DE&apn_uid=caedf34a-2c5c-4ca1-8d60-14a58ef0d500&apn_sauid=B3E2833F-1148-4DC5-9449-8AA579D3417A
SearchScopes: HKCU - {87C7DAB5-00A2-49E3-8892-ADF265F0308A} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6OySRaoenk&i=26
SearchScopes: HKCU - {F33C6390-D1E5-45D5-9694-672A7C1B29BE} URL = hxxp://ws.infospace.com/gamers_brw/ws/redir?_iceUrl=true&user_id=%userid&tool_id=%toolid&qkw={searchTerms}
BHO: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} ->  No File
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: avast! EasyPass Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} -  No File
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.1 -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin: @spoon.net/Spoon Plugin 3.33 -> C:\Program Files\Spoon\3.33.6.270\npMozillaSpoonPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} [2012-04-19]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-15]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-09-05]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-08-03]

Chrome: 
=======
CHR CustomProfile: C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23]
CHR Extension: (avast! Online Security) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-29]
CHR Extension: (RealPlayer Downloader) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-08-03]
CHR Extension: (Google Wallet) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07]
CHR HKLM\...\Chrome\Extension: [dkinklhnkmkhkhofcnapakaoehijaoih] - C:\Program Files\OnlineHD.TV\onhd11.crx []
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-08-05]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]
CHR HKLM\...\Chrome\Extension: [jifflliplgeajjdhmkcfnngfpgbjonjg] - C:\Program Files\Perion\NewTab\newTab.crx [2012-11-01]
CHR HKLM\...\Chrome\Extension: [kpkbnefaikfaeadgidhpoanckoiaheli] - C:\Program Files\HDvidCodec.com\HDvidCodec10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [lbbbdmbjkgojacipgefbifkiebpcdjhn] - C:\Program Files\Movie2KDownloader.com\m2kDownloader10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx [2012-11-01]
CHR StartMenuInternet: Google Chrome - C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-08-05] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [106488 2014-08-05] (AVAST Software)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()
R2 RealPlayer Cloud Service; c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-08-03] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-26] () [File not signed]
R2 STRATO HiDrive Service; C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-07-05] (STRATO) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
R2 yewimmxqbs32; C:\Program Files\002\yewimmxqbs32.exe [541696 2014-04-30] () [File not signed]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-05] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-08-05] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-05] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [270752 2014-08-05] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-08-05] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-05] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-05] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-05] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-08-05] (AVAST Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-05] ()
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
S3 optousb; C:\Windows\System32\DRIVERS\optousb.sys [18432 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S3 optovcm; C:\Windows\System32\DRIVERS\optovcm.sys [26368 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2011-09-10] (Duplex Secure Ltd.)
R3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [184192 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2011-07-05] (The OpenVPN Project)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST
2014-09-23 12:33 - 2014-09-23 12:34 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:17 - 2014-09-23 12:42 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-08-28 21:01 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 21:01 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2020-10-02 21:05 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2020-10-02 21:03 - 2011-09-05 12:24 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST
2014-09-23 12:42 - 2014-09-23 12:17 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-09-23 12:40 - 2011-09-06 15:21 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-23 12:39 - 2013-07-19 21:42 - 00000000 ___RD () C:\Users\muck\Dropbox
2014-09-23 12:39 - 2013-07-19 21:39 - 00000000 ____D () C:\Users\muck\AppData\Roaming\Dropbox
2014-09-23 12:37 - 2011-09-06 15:21 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-23 12:35 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-23 12:35 - 2009-07-14 06:39 - 00101574 _____ () C:\Windows\setupact.log
2014-09-23 12:34 - 2014-09-23 12:33 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:34 - 2011-09-04 18:48 - 01706085 _____ () C:\Windows\WindowsUpdate.log
2014-09-23 12:33 - 2012-03-31 18:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-23 12:33 - 2011-09-04 18:49 - 00000000 ____D () C:\Users\muck
2014-09-23 11:56 - 2011-11-01 10:37 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000UA.job
2014-09-23 11:17 - 2010-12-30 10:18 - 00000000 ____D () C:\Users\muck\Downloads\programme
2014-09-23 09:51 - 2014-04-30 11:24 - 00000000 ____D () C:\temp
2014-09-23 09:51 - 2011-11-14 19:38 - 00000000 ____D () C:\Program Files\ScanIT-Client
2014-09-23 07:33 - 2012-03-31 18:13 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-23 07:33 - 2011-10-05 19:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-23 06:40 - 2013-04-24 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-30 23:03 - 2010-01-05 13:48 - 00000000 ____D () C:\ProgramData\Temp
2014-08-30 22:37 - 2011-12-27 22:15 - 00007607 _____ () C:\Users\muck\AppData\Local\Resmon.ResmonCfg
2014-08-30 20:56 - 2011-11-01 10:37 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000Core.job
2014-08-30 20:42 - 2009-07-14 06:33 - 03127952 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 20:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-08-25 06:53 - 2010-01-05 11:57 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-24 19:33 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s

Some content of TEMP:
====================
C:\Users\muck\AppData\Local\Temp\99310uninstall.exe
C:\Users\muck\AppData\Local\Temp\AskSLib.dll
C:\Users\muck\AppData\Local\Temp\BackupSetup.exe
C:\Users\muck\AppData\Local\Temp\Cloud_Backup_Setup_euro.exe
C:\Users\muck\AppData\Local\Temp\distro-amzn-adknowledge-rs.exe
C:\Users\muck\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv3wdps.dll
C:\Users\muck\AppData\Local\Temp\frnd2wtd.dll
C:\Users\muck\AppData\Local\Temp\f_kz3t_c.dll
C:\Users\muck\AppData\Local\Temp\htmlayout.dll
C:\Users\muck\AppData\Local\Temp\InstallAX.exe
C:\Users\muck\AppData\Local\Temp\installhelper.dll
C:\Users\muck\AppData\Local\Temp\InstallPlugin.exe
C:\Users\muck\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\mediaimpression_1.5.42.419_1.5.42.1202_update_all.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083336.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083344.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7118_Size_36943976.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7121_Size_36936376.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7128_Size_37008752.exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader(1).exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader.exe
C:\Users\muck\AppData\Local\Temp\nitro_reader3.exe
C:\Users\muck\AppData\Local\Temp\nsgAE6C.exe
C:\Users\muck\AppData\Local\Temp\nsiD2F.exe
C:\Users\muck\AppData\Local\Temp\nsmFD22.tmp.exe
C:\Users\muck\AppData\Local\Temp\nss3FA.exe
C:\Users\muck\AppData\Local\Temp\nss6447.exe
C:\Users\muck\AppData\Local\Temp\nsx5DB1.exe
C:\Users\muck\AppData\Local\Temp\setup.exe
C:\Users\muck\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\muck\AppData\Local\Temp\Sqlite3.dll
C:\Users\muck\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\muck\AppData\Local\Temp\stubhelper.dll
C:\Users\muck\AppData\Local\Temp\uninst1.exe
C:\Users\muck\AppData\Local\Temp\uninstall8547996.exe
C:\Users\muck\AppData\Local\Temp\vcredist_x86.exe
C:\Users\muck\AppData\Local\Temp\YontooSetup-S.exe
C:\Users\muck\AppData\Local\Temp\_is4C6A.exe
C:\Users\muck\AppData\Local\Temp\_is52E.exe
C:\Users\muck\AppData\Local\Temp\_isD195.exe
C:\Users\muck\AppData\Local\Temp\_TinDel.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-25 20:26

==================== End Of Log ============================
         
--- --- ---



Gmerlog:
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-23 14:49:45
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0003 465,76GB
Running: tusxwiur.exe; Driver: C:\Users\muck\AppData\Local\Temp\pwldypoc.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwAddBootEntry [0x9112DBA6]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwAssignProcessToJobObject [0x9112E684]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateEvent [0x9113A6F8]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateEventPair [0x9113A744]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateIoCompletion [0x9113A8DE]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateMutant [0x9113A666]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwCreateSection [0x8B79EDF0]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateSemaphore [0x9113A6AE]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwCreateThread [0x8B79F080]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwCreateThreadEx [0x8B79F16A]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwCreateTimer [0x9113A898]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwDebugActiveProcess [0x9112F472]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwDeleteBootEntry [0x9112DC0C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwDuplicateObject [0x91132C68]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwLoadDriver [0x9112D7F8]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwMapViewOfSection [0x8B79EED0]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwModifyBootEntry [0x9112DC72]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwNotifyChangeKey [0x9113305E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwNotifyChangeMultipleKeys [0x9112FF5A]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenEvent [0x9113A722]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenEventPair [0x9113A766]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenIoCompletion [0x9113A902]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenMutant [0x9113A68C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenProcess [0x91132560]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenSection [0x9113A816]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenSemaphore [0x9113A6D6]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenThread [0x9113294C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwOpenTimer [0x9113A8BC]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwProtectVirtualMemory [0x8B79EC6E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwQueryObject [0x9112FDCE]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwQueueApcThreadEx [0x9112FADC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetBootEntryOrder [0x9112DCD8]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetBootOptions [0x9112DD3E]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwSetContextThread [0x8B79EFCC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetSystemInformation [0x9112D892]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSetSystemPowerState [0x9112DA64]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwShutdownSystem [0x9112D9F2]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSuspendProcess [0x9112F63C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSuspendThread [0x9112F79E]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwSystemDebugControl [0x9112DAEC]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwTerminateProcess [0x8B79ED3C]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwTerminateThread [0x9112F2CC]
SSDT            \SystemRoot\system32\drivers\aswSnx.sys                                                                                                                                                           ZwVdmControl [0x9112DDA4]
SSDT            \SystemRoot\system32\drivers\aswSP.sys                                                                                                                                                            ZwWriteVirtualMemory [0x8B79EBA0]

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                                                                                                          83084A15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                                                                            830BE212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 10CB                                                                                                                                                               830C5460 4 Bytes  [A6, DB, 12, 91] {CMPSB ; FIST DWORD [EDX]; XCHG ECX, EAX}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1153                                                                                                                                                               830C54E8 4 Bytes  [84, E6, 12, 91]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11A7                                                                                                                                                               830C553C 8 Bytes  [F8, A6, 13, 91, 44, A7, 13, ...] {CLC ; CMPSB ; ADC EDX, [ECX-0x6eec58bc]}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11B3                                                                                                                                                               830C5548 4 Bytes  [DE, A8, 13, 91]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11CF                                                                                                                                                               830C5564 4 Bytes  [66, A6, 13, 91]
.text           ...                                                                                                                                                                                               
PAGE            ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 108                                                                                                                                                       832804EF 4 Bytes  CALL 91130641 \SystemRoot\system32\drivers\aswSnx.sys
PAGE            ntkrnlpa.exe!ZwAlpcSendWaitReceivePort + 122                                                                                                                                                      8329A357 4 Bytes  CALL 91130657 \SystemRoot\system32\drivers\aswSnx.sys

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe[148] kernel32.dll!GetBinaryTypeW + 70                                                                                                             75846AAC 1 Byte  [62]
.text           C:\Windows\system32\csrss.exe[488] kernel32.dll!GetBinaryTypeW + 70                                                                                                                               75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wininit.exe[556] kernel32.dll!GetBinaryTypeW + 70                                                                                                                             75846AAC 1 Byte  [62]
.text           C:\Windows\system32\csrss.exe[576] kernel32.dll!GetBinaryTypeW + 70                                                                                                                               75846AAC 1 Byte  [62]
.text           C:\Windows\system32\services.exe[612] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               
.text           C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!SetUnhandledExceptionFilter                                                                                                7582F5AB 8 Bytes  [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text           C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!GetBinaryTypeW + 70                                                                                                        75846AAC 1 Byte  [62]
.text           C:\Windows\System32\spoolsv.exe[1636] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[1676] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe[1696] KERNEL32.dll!GetBinaryTypeW + 70                                                                                                75846AAC 1 Byte  [62]
.text           C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!SetUnhandledExceptionFilter                                                                                                 7582F5AB 8 Bytes  [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text           C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!GetBinaryTypeW + 70                                                                                                         75846AAC 1 Byte  [62]
.text           c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe[1860] kernel32.dll!GetBinaryTypeW + 70                                                                                                       75846AAC 1 Byte  [62]
.text           C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe[1864] kernel32.dll!GetBinaryTypeW + 70                                                                                           75846AAC 1 Byte  [62]
.text           C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe[2076] kernel32.dll!GetBinaryTypeW + 70                                                                                                75846AAC 1 Byte  [62]
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2100] kernel32.dll!GetBinaryTypeW + 70                                                                                     75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               
.text           C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!SetUnhandledExceptionFilter                                                                                                 7582F5AB 8 Bytes  [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text           C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!GetBinaryTypeW + 70                                                                                                         75846AAC 1 Byte  [62]
.text           C:\Windows\system32\Dwm.exe[3256] kernel32.dll!GetBinaryTypeW + 70                                                                                                                                75846AAC 1 Byte  [62]
.text           C:\Windows\Explorer.EXE[3284] kernel32.dll!GetBinaryTypeW + 70                                                                                                                                    75846AAC 1 Byte  [62]
.text           C:\Program Files\Windows Media Player\wmpnetwk.exe[3460] kernel32.dll!GetBinaryTypeW + 70                                                                                                         75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wbem\wmiprvse.exe[3484] kernel32.dll!GetBinaryTypeW + 70                                                                                                                      75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               
.text           C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!SetUnhandledExceptionFilter                                                                                              7582F5AB 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text           C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!GetBinaryTypeW + 70                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4416] kernel32.dll!GetBinaryTypeW + 70                                                                                     75846AAC 1 Byte  [62]
.text           C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4456] kernel32.dll!GetBinaryTypeW + 70                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe[4464] kernel32.dll!GetBinaryTypeW + 70                                                                                             75846AAC 1 Byte  [62]
.text           C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!SetUnhandledExceptionFilter                                                                                            7582F5AB 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text           C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!GetBinaryTypeW + 70                                                                                                    75846AAC 1 Byte  [62]
.text           C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4500] kernel32.dll!GetBinaryTypeW + 70                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Windows\system32\svchost.exe[4752] kernel32.dll!GetBinaryTypeW + 70                                                                                                                            75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wbem\unsecapp.exe[4812] kernel32.dll!GetBinaryTypeW + 70                                                                                                                      75846AAC 1 Byte  [62]
.text           C:\Windows\system32\wbem\wmiprvse.exe[4888] kernel32.dll!GetBinaryTypeW + 70                                                                                                                      75846AAC 1 Byte  [62]
.text           ...                                                                                                                                                                                               

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                                                                                           aswTdi.SYS
AttachedDevice  \Driver\tdx \Device\Udp                                                                                                                                                                           aswTdi.SYS
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                                                                          fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                                  
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                               0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                               0
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                            0xA2 0x9B 0x87 0xD2 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                              
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                   0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                   0
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                0xA2 0x9B 0x87 0xD2 ...
Reg             HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\muck\Downloads\programme\Adobe_Creative_Suite\x00a05_Master_Collection-AkamaiDLM.exe  1

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                                                                                                                             unknown MBR code

---- EOF - GMER 2.1 ----
         

Vielen Dank für Eure Hilfe

 

Themen zu Trojaner an Board: Win32:BProtect-D [Trj] System:Win7
administrator, antivirus, avast, dll, dsl, fehlercode 0x81000006, fehlercode 22, fehlercode 43, firewall, flash player, helper, home, newtab, realtek, registry, security, services.exe, system, this device cannot start. (code10), this device is disabled. (code 22), trojaner, vcredist, windows, winlogon.exe




Ähnliche Themen: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7


  1. PC langsam, hängt sich beim Surfen auf, Bluescreen, Advanced System Protector, Win32:Dropper-gen, Win32:Malware-gen, Win32:Rootkit-gen u.a.
    Log-Analyse und Auswertung - 07.02.2015 (12)
  2. Win7 BProtect und Adware sowie Addlyrics auf dem Laptop gefunden
    Plagegeister aller Art und deren Bekämpfung - 13.12.2014 (13)
  3. Win7 Prof. Infiziert mit Win32/Packed.Asprotect.DS Trojaner! Entfernung?
    Log-Analyse und Auswertung - 01.10.2014 (9)
  4. Windows 8: Win32:BProtect-J [Trj]
    Log-Analyse und Auswertung - 11.08.2014 (9)
  5. Trojaner: Advanced System Protector, Win7
    Log-Analyse und Auswertung - 11.08.2014 (7)
  6. Windows 7: Avast meldete Infektion durch win32:bprotect-D
    Log-Analyse und Auswertung - 23.06.2014 (17)
  7. WIN7: AVAST meldet Win32:Bprotect-D /-F /-H und weitere, Rechner läuft
    Log-Analyse und Auswertung - 05.06.2014 (12)
  8. Windows 7 : Avast fand Win32:BProtect-D [Trj] - Löschung nicht möglich
    Log-Analyse und Auswertung - 27.05.2014 (10)
  9. Windows 7: Win32:BProtect-D
    Plagegeister aller Art und deren Bekämpfung - 13.05.2014 (13)
  10. System mit BKA-Trojaner ähnlichem Schädling infiziert (Win7 Home Premium)
    Log-Analyse und Auswertung - 17.04.2014 (7)
  11. Windows 7: diverse Viren nach Avast Scan erkannt z.B. Win32:BProtect-D
    Log-Analyse und Auswertung - 24.01.2014 (12)
  12. GVU-Trojaner befallen/Win7- System wiederhergestellt und nun?
    Plagegeister aller Art und deren Bekämpfung - 10.01.2013 (3)
  13. GVU-Trojaner auf Win7 (64bit) System
    Plagegeister aller Art und deren Bekämpfung - 06.09.2012 (9)
  14. Avira nicht installierbar, Rechner langsam und Win32 und andere Trojaner an Board
    Plagegeister aller Art und deren Bekämpfung - 02.02.2012 (3)
  15. gleiches Problem wie http://www.trojaner-board.de/99057-das-system-hat-ein-problem-mit-einem-oder-me
    Plagegeister aller Art und deren Bekämpfung - 26.05.2011 (1)
  16. pin-tan-bank-trojaner / system neuaufsetzen vist->win7
    Plagegeister aller Art und deren Bekämpfung - 20.10.2010 (12)
  17. Win32/mebroot Trojaner auf Win7
    Antiviren-, Firewall- und andere Schutzprogramme - 07.06.2010 (2)

Zum Thema Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Guten Tag zusammen, Avast premium hat mir beim heutigen Suchlauf folgenden Trojaner gemeldet Win32:BProtect-D [Trj] Avast kann ihn nicht in den Container verschieben. Ich hätte dieses Ding gerne los und - Trojaner an Board: Win32:BProtect-D [Trj] System:Win7...
Archiv
Du betrachtest: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.