| |
| |||||||
Log-Analyse und Auswertung: Problem mit Explorer & SystemwiederherstellungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
14.12.2008, 14:46
| #1 |
 |  Problem mit Explorer & Systemwiederherstellung Hallo zusammen, ich hatte hier begonnen zu schreiben, da meine Problematik exakt die gleiche als die von "MAslaner", dabei habe ich gegen die Boardregeln verstoßen, wofür ich mich hier nocheinmal entschuldige. Als erstes hab ich HJT drüber laufen lassen: Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 05:24:16, on 14.12.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\ProgZ\Microsoft Office\Office12\GrooveMonitor.exe C:\Programme\Microsoft IntelliType Pro\itype.exe C:\WINDOWS\system32\rundll32.exe C:\ProgZ\cFosSpeed\cFosSpeed.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Programme\FreePDF_XP\fpassist.exe C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\WiFi SiStr.exe C:\Programme\Microsoft IntelliType Pro\dpupdchk.exe C:\ProgZ\IVT Corporation\BlueSoleil\BTNtService.exe C:\Programme\Bonjour\mDNSResponder.exe C:\ProgZ\cFosSpeed\spd.exe C:\WINDOWS\system32\svchost.exe C:\ProgZ\Borland\InterBase\bin\ibguard.exe C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\atwtusb.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\svchost.exe C:\ProgZ\Borland\InterBase\bin\ibserver.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\ProgZ\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,C:\ProgZ\KGB\MPK.exe O1 - Hosts: 66.98.148.65 auto.search.msn.com O1 - Hosts: 66.98.148.65 auto.search.msn.es O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\ProgZ\Mindjet\MindManager 7\Mm7InternetExplorer.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ProgZ\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [GrooveMonitor] "C:\ProgZ\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [itype] "C:\Programme\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [BIH] C:\WINDOWS\system32\rundll32.exe bih.dll,InitGauge O4 - HKLM\..\Run: [cFosSpeed] C:\ProgZ\cFosSpeed\cFosSpeed.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\ProgZ\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [AnyDVD] C:\ProgZ\SlySoft\AnyDVD\AnyDVDtray.exe O4 - HKCU\..\Run: [WiFiSiStr] C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\WiFi SiStr.exe O4 - HKLM\..\Policies\Explorer\Run: [Mpk.exe] C:\ProgZ\KGB\Mpk.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Microsoft Office Outlook 2007.lnk = ? O4 - Startup: Samurize.lnk = C:\ProgZ\Samurize\Client.exe O4 - Startup: SysTool.lnk = C:\ProgZ\SysTool\SysTool.exe O8 - Extra context menu item: &NeoTrace It! - C:\ProgZ\NEOTRA~1\NTXcontext.htm O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\ProgZ\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ProgZ\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ProgZ\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ProgZ\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\ProgZ\Mindjet\MindManager 7\Mm7InternetExplorer.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ProgZ\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ProgZ\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\ProgZ\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\ProgZ\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\ProgZ\NEOTRA~1\NTXtoolbar.htm (HKCU) O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ProgZ\MICROS~1\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: C:\ProgZ\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: crypt - C:\WINDOWS\ O20 - Winlogon Notify: wvjtyi - C:\WINDOWS\SYSTEM32\wvjtyi.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\ProgZ\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\ProgZ\cFosSpeed\spd.exe O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\ProgZ\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\ProgZ\Borland\InterBase\bin\ibguard.exe O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\ProgZ\Borland\InterBase\bin\ibserver.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\ProgZ\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe O23 - Service: WTService - Unknown owner - C:\WINDOWS\system32\atwtusb.exe -- End of file - 8586 bytes Dann hab ich "MBAM" drüber laufen lassen, da hat er mir aber nach dem Restart die Dateien nicht gelöscht, da ich die "mbam.exe" in "test.exe" umbennen musste, da das Programm sonst vom Virus geblockt wurde: Log: Malwarebytes' Anti-Malware 1.31 Datenbank Version: 1456 Windows 5.1.2600 Service Pack 2 14.12.2008 08:23:08 mbam-log-2008-12-14 (08-23-08).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 223131 Laufzeit: 2 hour(s), 17 minute(s), 59 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 2 Infizierte Registrierungsschlüssel: 15 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 1 Infizierte Dateien: 36 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\system32\wvjtyi32.dll (Trojan.FakeAlert) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvjtyi (Trojan.FakeAlert) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\restore (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fci (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\fci (Rootkit.ADS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\fci (Rootkit.ADS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt (Trojan.Downloader) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\WINDOWS\system32\IE updates (Adware.Agent) -> Quarantined and deleted successfully. Infizierte Dateien: C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\system32\wvjtyi32.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\Adobe Pdf Money Guide.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\ebook_library.dll (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\Checker.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSbrsr.dll (Trojan.TDSS) -> Delete on reboot. C:\WINDOWS\system32\TDSSoiqh.dll (Trojan.TDSS) -> Delete on reboot. C:\WINDOWS\system32\TDSSpaxt.dll (Trojan.TDSS) -> Delete on reboot. C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Delete on reboot. C:\WINDOWS\system32\TDSSxfum.dll (Trojan.TDSS) -> Delete on reboot. C:\WINDOWS\system32\drivers\ati3jqxx.sys (Rootkit.Agent) -> Delete on reboot. C:\WINDOWS\system32\drivers\TDSSmqlt.sys (Trojan.TDSS) -> Delete on reboot. C:\WINDOWS\Temp\akk10.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\qpm7.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\uig2.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\yyl1C.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BN1A.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BN5.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BN59.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BN7.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BN8.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\BNF.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\IE updates\Roulette Cheat Guide - Make Money Online TODAY.url (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\IE updates\sexYsexlog.url (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\Crack.txt (Rogue.Link) -> Quarantined and deleted successfully. C:\WINDOWS\system32\How To Use The Checker.pdf (Rogue.Link) -> Quarantined and deleted successfully. C:\WINDOWS\Quick Money Guide.pdf (Rogue.Link) -> Quarantined and deleted successfully. C:\WINDOWS\Read Me First.txt (Rogue.Link) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\svchost.exe:ext.exe (Rootkit.ADS) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Kri\Favoriten\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Kri\Favoriten\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Kri\Favoriten\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSScfub.log (Trojan.TDSS) -> Delete on reboot. C:\WINDOWS\system32\TDSSlxwp.dll (Rootkit.Agent) -> Delete on reboot. C:\WINDOWS\system32\TDSSoeqh.dll (Rootkit.Agent) -> Delete on reboot. Dann hab ich die "test.exe" wieder in "mbam.exe" zurückumbenannt und das ganze nochmal laufen lassen: Log: Malwarebytes' Anti-Malware 1.31 Datenbank Version: 1456 Windows 5.1.2600 Service Pack 2 14.12.2008 13:20:52 mbam-log-2008-12-14 (13-20-52).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 223199 Laufzeit: 2 hour(s), 17 minute(s), 0 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 1 Infizierte Registrierungsschlüssel: 8 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 7 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvjtyi (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\restore (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot. C:\System Volume Information\_restore{363705E3-18DA-47DE-BC8B-B374215ABDF6}\RP211\A0101815.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati3jqxx.sys (Rootkit.Agent) -> Delete on reboot. C:\WINDOWS\Temp\BN5.tmp (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\svchost.exe:ext.exe (Rootkit.ADS) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Kri\Lokale Einstellungen\Temp\TDSS2b64.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Kri\Lokale Einstellungen\Temp\TDSS2b83.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. (Fortsetzung folgt..) |
| Themen zu Problem mit Explorer & Systemwiederherstellung |
| 8.tmp, adobe, adware.agent, bho, bonjour, computer, controlset002, dll, einstellungen, ellung, error, explorer, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, internet security, kaspersky, log, magix, malwarebytes' anti-malware, problem, programme, registrierungsschlüssel, rogue.link, rootkit.agent, rundll, security, senden, software, spyware, temp, trojan.downloader, trojan.tdss, updates, userinit.exe, windows, windows xp, windows\temp |
Baum-Darstellung