| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Crypt.Xpack.gen bitte um HilfeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
21.03.2009, 03:33
| #1 |
 |  TR/Crypt.Xpack.gen bitte um Hilfe Hi erstmal hier im Forum habe ein großes Problem alles fing damit an das ich mir was runterladen wollte und auf einmal den genannten Trojaner auf dem Rechner habe und nun verzweifelt versuche ihn weg zu bekommen. Problem ist das kaum noch was reagiert mein Antivir tut gar nix mehr und runterladen von datein geht nur noch mit 5 kb deswegen konnt ich auch kein HijackThis runterladen und updaten und auch nicht mein spybot search and destroy sie lassen sich beide nicht updaten und danach starten . Habe dan das andere Programm benutz was ihr empfolen habt ComboFix verbessert hat sich aber nix , was empfehlt ihr mir , bitte um schnelle hilfe. ComboFix 09-03-19.02 - Andre 2009-03-21 3:12:13.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.3066.1810 [GMT 1:00] ausgeführt von:: c:\users\****\Desktop\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\****\AppData\Roaming\.# c:\windows\system32\AutoRun.inf d:\recycler\S-8-6-94-100021743-100012167-100001690-4016.com . ((((((((((((((((((((((( Dateien erstellt von 2009-02-21 bis 2009-03-21 )))))))))))))))))))))))))))))) . 2009-03-21 03:10 . 2009-03-21 03:10 <DIR> d-------- c:\program files\CCleaner 2009-03-21 03:02 . 2009-03-21 03:02 118 --a------ c:\windows\System32\MRT.INI 2009-03-20 00:31 . 2009-03-20 00:31 <DIR> d-------- c:\users\Andre\AppData\Roaming\S.A.D 2009-03-20 00:31 . 2009-03-20 00:31 <DIR> d-------- c:\program files\AudioJack 2 2009-03-19 22:57 . 2009-03-20 14:45 <DIR> d-------- c:\users\Andre\AppData\Roaming\Tobit 2009-03-19 22:44 . 2009-03-19 22:56 <DIR> d-------- c:\users\Andre\AppData\Roaming\phonostar-Player 2009-03-19 22:28 . 2009-03-19 22:56 <DIR> d-------- c:\program files\Messer 2009-03-17 18:42 . 2009-03-17 18:42 <DIR> d-------- c:\users\All Users\WEBREG 2009-03-17 18:42 . 2009-03-17 18:42 <DIR> d-------- c:\programdata\WEBREG 2009-03-17 18:41 . 2009-03-17 18:41 <DIR> d-------- c:\users\Andre\AppData\Roaming\HPAppData 2009-03-17 18:41 . 2009-03-17 18:41 <DIR> d-------- c:\users\All Users\HPSSUPPLY 2009-03-17 18:41 . 2009-03-17 18:41 <DIR> d-------- c:\programdata\HPSSUPPLY 2009-03-17 18:40 . 2009-03-17 18:40 <DIR> d-------- c:\users\All Users\HP Product Assistant 2009-03-17 18:40 . 2009-03-17 18:40 <DIR> d-------- c:\programdata\HP Product Assistant 2009-03-17 18:40 . 2009-03-17 18:40 <DIR> d-------- c:\program files\Hewlett-Packard 2009-03-17 18:40 . 2009-03-17 18:40 <DIR> d-------- c:\program files\Common Files\HP 2009-03-17 18:40 . 2009-03-17 18:40 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard 2009-03-17 18:39 . 2009-03-17 18:39 <DIR> d-------- c:\users\All Users\Hewlett-Packard 2009-03-17 18:39 . 2009-03-17 18:39 <DIR> d-------- c:\programdata\Hewlett-Packard 2009-03-17 18:38 . 2009-03-17 18:41 <DIR> d-------- c:\program files\HP 2009-03-17 18:38 . 2007-03-17 17:11 675,840 --a------ c:\windows\System32\hpowiax3.dll 2009-03-17 18:38 . 2007-03-17 17:11 569,344 --a------ c:\windows\System32\hpotscl3.dll 2009-03-17 18:38 . 2007-03-08 05:20 364,544 --a------ c:\windows\System32\hppldcoi.dll 2009-03-17 18:38 . 2007-03-17 17:11 303,104 --a------ c:\windows\System32\hpovst10.dll 2009-03-17 18:38 . 2007-03-30 16:07 267,864 --a------ c:\windows\System32\hpzids01.dll 2009-03-17 18:38 . 2007-03-28 14:01 117,760 --a------ c:\windows\System32\hpzll5ha.dll 2009-03-17 18:37 . 2009-03-17 18:42 <DIR> d-------- c:\users\All Users\HP 2009-03-17 18:37 . 2009-03-17 18:42 <DIR> d-------- c:\programdata\HP 2009-03-17 18:37 . 2009-03-17 18:42 160,154 --a------ c:\windows\hpoins14.dat 2009-03-13 19:29 . 2009-03-13 19:29 <DIR> d-------- c:\windows\Sun 2009-03-11 00:31 . 2008-12-16 04:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2009-03-11 00:31 . 2008-12-16 06:31 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-11 00:31 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-11 00:31 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\dxmasf.dll 2009-03-11 00:29 . 2009-02-09 04:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-03-11 00:29 . 2008-11-27 05:43 268,288 --a------ c:\windows\System32\schannel.dll 2009-03-08 21:33 . 2009-03-11 21:33 <DIR> d-------- c:\program files\PokerStars.NET 2009-03-08 20:50 . 2009-03-08 20:53 <DIR> d--h----- c:\windows\Icons 2009-03-08 16:49 . 2009-03-08 16:49 <DIR> d-------- c:\users\Andre\AppData\Roaming\TuneUp Software 2009-03-08 16:49 . 2009-03-08 16:49 <DIR> d-------- c:\users\All Users\TuneUp Software 2009-03-08 16:49 . 2009-03-08 16:49 <DIR> d-------- c:\programdata\TuneUp Software 2009-03-08 16:49 . 2009-03-08 16:49 <DIR> d-------- c:\program files\TuneUp Utilities 2009 2009-03-08 16:49 . 2009-03-08 16:49 603,904 --a------ c:\windows\System32\TUProgSt.exe 2009-03-08 16:49 . 2009-03-08 16:49 360,192 --a------ c:\windows\System32\TuneUpDefragService.exe 2009-03-08 16:49 . 2008-12-11 13:31 27,904 --a------ c:\windows\System32\uxtuneup.dll 2009-03-08 16:49 . 2008-12-11 13:31 17,152 --a------ c:\windows\System32\authuitu.dll 2009-03-08 16:48 . 2009-03-08 16:48 <DIR> d--hs---- c:\users\All Users\{55A29068-F2CE-456C-9148-C869879E2357} 2009-03-08 16:48 . 2009-03-08 16:48 <DIR> d--hs---- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357} 2009-03-02 10:15 . 2009-03-02 10:15 20,480 --a------ c:\windows\System32\H@tKeysH@@k.DLL . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-21 02:11 --------- d-----w c:\programdata\Spybot - Search & Destroy 2009-03-21 01:29 27,839 ----a-w c:\users\All Users\nvModes.dat 2009-03-21 01:29 27,839 ----a-w c:\programdata\nvModes.dat 2009-03-21 01:29 --------- d-----w c:\program files\Warcraft III 2009-03-21 01:20 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-03-21 00:56 --------- d-----w c:\program files\Launch Manager 2009-03-21 00:16 --------- d-----w c:\users\Andre\AppData\Roaming\Winamp 2009-03-21 00:16 --------- d-----w c:\program files\Steam 2009-03-21 00:16 --------- d-----w c:\program files\Common Files\Steam 2009-03-12 01:42 --------- d-----w c:\program files\Windows Mail 2009-03-09 21:14 --------- d-----w c:\program files\ICQ6.5 2009-03-08 19:24 --------- d-----w c:\program files\Google 2009-03-08 16:07 --------- d-----w c:\program files\Acer GameZone 2009-03-08 16:05 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-07 16:34 --------- d-----w c:\users\Andre\AppData\Roaming\CyberLink 2009-02-16 20:40 --------- d-----w c:\users\Andre\AppData\Roaming\Skype 2009-02-16 15:08 --------- d-----w c:\users\Andre\AppData\Roaming\skypePM 2009-02-13 21:23 --------- d-----w c:\program files\EA Games 2009-02-09 08:37 --------- d-----w c:\programdata\Nero 2009-02-08 20:00 --------- d-----w c:\program files\Nero 2009-01-31 16:04 --------- d-----w c:\program files\KaloMa 2009-01-27 19:03 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE 2009-01-23 19:49 107,888 ----a-w c:\windows\System32\CmdLineExt.dll 2009-01-23 19:36 --------- d-----w c:\program files\Bethesda Softworks 2009-01-22 00:10 --------- d-----w c:\programdata\CyberLink 2009-01-21 00:56 --------- d-----w c:\program files\Azureus 2009-01-18 17:38 2,829 ----a-w c:\windows\War3Unin.pif 2009-01-18 17:38 139,264 ----a-w c:\windows\War3Unin.exe 2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll 2009-01-14 17:46 66,872 ----a-w c:\windows\System32\PnkBstrA.exe 2009-01-14 17:46 22,328 ----a-w c:\users\Andre\AppData\Roaming\PnkBstrK.sys 2009-01-14 17:46 2,250,024 ----a-w c:\windows\System32\pbsvc.exe 2009-01-14 17:46 107,832 ----a-w c:\windows\System32\PnkBstrB.exe 2009-01-08 17:21 410,984 ----a-w c:\windows\System32\deploytk.dll 2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-03-04 23:38 121392 --a------ c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-05 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-23 397312] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-07 13543968] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-07 92704] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 821768] "ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "MRT"="c:\windows\system32\MRT.exe" [2009-02-25 24768960] "RtHDVCpl"="RtHDVCpl.exe" [2008-04-28 c:\windows\RtHDVCpl.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-11-07 14:31 21633320 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2009-01-16 10:06 1410296 c:\program files\Steam\Steam.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" "ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" "eDataSecurity Loader"=c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe "PLFSetI"=c:\windows\PLFSetI.exe "HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{F76B449B-026D-4A3F-89ED-1FF673FBDAF6}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{36136249-3502-4D13-B6F0-524D22EB1BDA}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{6D41BBC8-3313-46DE-AE4A-8441CFF5CF1E}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{E7BC0F42-8139-48E4-A226-EE254FD3E9F0}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{7F40A20A-ECCF-4B08-AAE4-34BB517B06C5}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{86AB5221-F056-4E52-9DC5-F94A59240ECC}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{5D000235-4036-425E-9F37-5759E5E48319}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{0D8AEE10-96C2-498F-AEB7-7902F449EFB9}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{752D16C6-99C9-4B06-8BD1-5813BC6C3EEE}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{15DA2A09-5B39-4A15-89B5-8E90FA690BDD}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe "{5C955116-8F5F-46CF-8557-9C0665820430}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie "{C74DF51B-BBA8-41E1-9B3D-1F8963739CEB}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program "{EDB08CC0-9FD8-4DD9-8389-6BD58415A979}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia "TCP Query User{90FCBFF0-25EB-42BF-BD41-691B81AB10E0}c:\\program files\\icq6.5\\icq.exe"= UDP:c:\program files\icq6.5\icq.exe:ICQ Library "UDP Query User{EBAF54C6-ECF6-4984-9B20-895D1D9964D6}c:\\program files\\icq6.5\\icq.exe"= TCP:c:\program files\icq6.5\icq.exe:ICQ Library "{5A3076CB-9B10-466F-90B8-240C5168D045}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{AADBD855-267A-49E8-A556-0FA69B66D8F5}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{7DD129C1-D0E6-4A01-AC82-D5FA4222B6B7}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{7C244378-7DA9-4D2D-8ABF-90C1E80B98EA}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{CAC9137B-2CD3-41BB-AA76-B277D712FC80}"= UDP:c:\program files\Ubisoft\Far Cry 2\bin\FarCry2.exe:Far Cry 2 "{6E5E9B69-B79E-4B7E-9349-CAFE4BBC30F4}"= TCP:c:\program files\Ubisoft\Far Cry 2\bin\FarCry2.exe:Far Cry 2 "{FB4E8756-91F4-416C-977A-B3D4803AABB8}"= UDP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:Far Cry 2 Updater "{A3C731F5-7BE6-4A20-9A17-412B80D41733}"= TCP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:Far Cry 2 Updater "{00D89774-7EA4-4B68-96D4-CE17B0E1EBFC}"= UDP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Editor.exe:Editor "{795708F0-23BA-4B57-9F4C-3E1AC9174C6C}"= TCP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Editor.exe:Editor "{5292A1E3-F83E-4452-8A73-3AC263806CDC}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{0ED30DF5-6FCF-490A-A48A-7854C4DE482A}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{2697B13F-8655-4E85-9C1C-5BB6BD010057}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{66036C2A-96EF-482C-8C28-785296912E6B}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{E43B9CC2-892F-46C3-8E6D-8D475A4869A1}"= UDP:c:\sierra\Half-Life\hl.exe:Half-Life "{F24779AB-E043-4240-BC52-ED0249C22397}"= TCP:c:\sierra\Half-Life\hl.exe:Half-Life "TCP Query User{8A703933-5E83-42B9-8851-CCD1C60356D1}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III "UDP Query User{32F9610F-1451-42DF-812B-0EB9007C089B}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III "TCP Query User{57A265B1-BCA4-46C5-8758-2CB8CEACCD71}c:\\program files\\steam\\steamapps\\punisherdcow\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\punisherdcow\counter-strike source\hl2.exe:hl2 "UDP Query User{DA1BF73E-BA7B-4B65-8D8F-ECE119427D56}c:\\program files\\steam\\steamapps\\punisherdcow\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\punisherdcow\counter-strike source\hl2.exe:hl2 "{DA08AB34-DDF2-4970-A2B9-CDD4B15CB3B0}"= c:\program files\Skype\Phone\Skype.exe:Skype "TCP Query User{B3C392E3-8EF2-4B00-9C81-F3C40D6FFFF1}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III "UDP Query User{C38FC950-222B-41CD-BD36-9DEBBB207FAF}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III "TCP Query User{1BA2F2E3-6126-4DEC-9FF5-7C54AD121567}c:\\program files\\steam\\steamapps\\punisherdcow\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\punisherdcow\counter-strike source\hl2.exe:hl2 "UDP Query User{C24D5074-EA21-4921-8432-2016D8DFF457}c:\\program files\\steam\\steamapps\\punisherdcow\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\punisherdcow\counter-strike source\hl2.exe:hl2 R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-12-05 09:19:50 61424] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384] R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-12-05 81504] R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-10-31 24576] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-06 50424] R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-12-05 122368] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072] R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [2009-03-08 603904] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [2008-03-28 210432] R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-11-01 81296] R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\System32\drivers\NETw5v32.sys [2008-11-01 3658752] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [2008-11-01 44064] R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [2007-03-28 43008] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Inhalt des "geplante Tasks" Ordners 2009-03-21 c:\windows\Tasks\1-Klick-Wartung.job - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:07] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.de/ig?hl=de mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1208&m=aspire_7730g IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe FF - ProfilePath - c:\users\Andre\AppData\Roaming\Mozilla\Firefox\Profiles\1os4e0a4.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig?hl=de FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll ---- FIREFOX Richtlinien ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-21 03:13:37 Windows 6.0.6001 Service Pack 1 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... c:\users\Andre\AppData\Local\Temp\catchme.dll 53248 bytes executable Scan erfolgreich abgeschlossen versteckte Dateien: 1 ************************************************************************** . Zeit der Fertigstellung: 2009-03-21 3:14:48 ComboFix-quarantined-files.txt 2009-03-21 02:14:46 Vor Suchlauf: 20 Verzeichnis(se), 29.338.435.584 Bytes frei Nach Suchlauf: 20 Verzeichnis(se), 29,307,117,568 Bytes frei 251 --- E O F --- 2009-03-21 02:03:47 |
| Themen zu TR/Crypt.Xpack.gen bitte um Hilfe |
| 32-bit, antivir, auf einmal, avgnt, avgnt.exe, avira, bitte um hilfe, bonjour, combofix, components, counter-strike source, desktop, firefox, hijack, hijackthis, home, home premium, installation, internet, internet explorer, jusched.exe, kein hijackthis, launch, local\temp, malware, mozilla, popup, problem, programdata, programm, richtlinie, scan, service pack 1, sierra, starten, suchlauf, svchost, system, tr/crypt.xpack.ge, tr/crypt.xpack.gen, trojaner, windows |
Baum-Darstellung