| |
| |||||||
Log-Analyse und Auswertung: Windows Updates Funktionieren nicht und andere Updates.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
09.04.2009, 14:04
| #1 |
 |  Windows Updates Funktionieren nicht und andere Updates. Hallo Trojana Gemeinde, ich habe Folgendes Problemm; Ich kann nicht mehr meine Daten Updaten d.h. Avira Antivirus Defender geht nicht  .Hier mein Hijack log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:45:51, on 09.04.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\PLFSetI.exe C:\Users\Daniel\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Windows\System32\rundll32.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Skype\Phone\Skype.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Opera\opera.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=13166&l=dis R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE Systemboot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [MobMapUpdater] "C:\Program Files\MobMapUpdater\MobMapUpdater.exe" --silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O8 - Extra context menu item: &Alles mit BitComet herunterladen - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Alle &Videos mit BitComet herunterladen - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Mit BitComet herunter&laden - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O13 - Gopher Prefix: O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1231429105437&h=90ed87bd6a474824c13cd924be68ddf9/&filename=jinstall-6u11-windows-i586-jc.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{82131D18-0A32-4582-8C62-3809AAB7DDBA}: NameServer = 85.255.112.177,85.255.112.117 O17 - HKLM\System\CCS\Services\Tcpip\..\{B7FC0445-C87B-40E7-ABFD-7C8B01794D63}: NameServer = 85.255.112.177,85.255.112.117 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.177,85.255.112.117 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.177,85.255.112.117 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.177,85.255.112.117 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe (file missing) O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 9454 bytes PS: Wenn ich auf die Windows Seiten gehen will werde ich Automatisch auf GOOGLE oder irgendwelchen anderen seiten Weitergeleitet. Mfg DDanielDD |
|
09.04.2009, 14:10
| #2 |
  |  Windows Updates Funktionieren nicht und andere Updates. Hi,
__________________Achtung! Deine gesamte Internetverbindung wird über die Ukraine geroutet, nichts mehr mit Passwörtern (eBanking/eBay) etc. Rest folgt gleich.... chris
__________________ |
|
09.04.2009, 14:12
| #3 | |
| | Windows Updates Funktionieren nicht und andere Updates. So, here we go:
__________________Hijackthis, fixen: öffne das HijackThis -- Button "scan" -- vor den nachfolgenden Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten Beim fixen müssen alle Programme geschlossen sein! Code:
ATTFilter O17 - HKLM\System\CCS\Services\Tcpip\..\{82131D18-0A32-4582-8C62-3809AAB7DDBA}: NameServer = 85.255.112.177,85.255.112.117
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7FC0445-C87B-40E7-ABFD-7C8B01794D63}: NameServer = 85.255.112.177,85.255.112.117
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.177,85.255.112.117
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.177,85.255.112.117
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.177,85.255.112.117
Zitat:
Achtung: Solltest du Probleme mit deiner Internet Verbindung bekommen: Systemsteuerung > wähle Netzwerk und Internet Verbindungen oder mach einen Doppelklick auf Netzwerk-Verbindungen > Klick mit der rechten Maustaste auf Default Connection (Normale Verindung), das ist normalerweise die örtliche Umgebung, Kabel oder DSL Verbindung > Klick mit der linken Maustaste auf Eigenschaften > Doppelklick auf Internet Protocol (TCP/IP) > wähle den Knopf der dafür steht, dass die DNS Verbindung automatisch aufrecht erhalten wird > zweimal auf "OK" klicken > den Rechner neu starten (Diese Einstellungen sind nicht auf allen Systemen gleich oder vorhanden) Combofix Lade ComboFix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop. Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter. Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird. Nach Scanende wird ein Report angezeigt, den bitte kopieren und in deinem Thread einfuegen. Weitere Anleitung unter:http://www.bleepingcomputer.com/comb...x-benutzt-wird Hinweis: unter : C:\WINDOWS\erdnt wird ein Backup angelegt. Alternative downloads: http://subs.geekstogo.com/ComboFix.exe Malwarebytes Antimalware (MAM). Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html Fullscan und alles bereinigen lassen! Log posten. Alternativer Download: http://filepony.de/download-malwarebytes_anti_malware/, http://www.gt500.org/malwarebytes/mbam.jsp Chris
__________________ Geändert von Chris4You (09.04.2009 um 14:18 Uhr) |
|
09.04.2009, 14:36
| #4 |
| | Windows Updates Funktionieren nicht und andere Updates. ComboFix 09-04-04.01 - Daniel 2009-04-09 15:25:48.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.2557.1646 [GMT 2:00] ausgeführt von:: c:\users\Daniel\Desktop\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\windows\system32\gaopdxcounter D:\Autorun.inf . ((((((((((((((((((((((( Dateien erstellt von 2009-03-09 bis 2009-04-09 )))))))))))))))))))))))))))))) . 2009-04-09 15:05 . 2008-11-27 06:43 268,288 --a------ c:\windows\System32\schannel.dll 2009-04-09 15:04 . 2009-02-09 05:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-04-09 11:15 . 2009-04-09 11:15 <DIR> d-------- c:\users\Daniel\AppData\Roaming\Malwarebytes 2009-04-09 10:42 . 2009-04-09 10:42 <DIR> d-------- c:\users\All Users\Malwarebytes 2009-04-09 10:42 . 2009-04-09 10:42 <DIR> d-------- c:\programdata\Malwarebytes 2009-04-09 10:42 . 2009-04-09 10:42 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-04-09 10:42 . 2009-01-04 18:38 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-04-09 10:42 . 2009-01-04 18:38 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-04-09 10:15 . 2009-04-09 10:15 <DIR> d-------- c:\users\Daniel\AppData\Roaming\PowerCinema 2009-04-09 09:55 . 2009-04-09 11:15 <DIR> d-------- c:\users\All Users\PrevxCSI 2009-04-09 09:55 . 2009-04-09 11:15 <DIR> d-------- c:\programdata\PrevxCSI 2009-04-09 09:55 . 2009-04-09 09:55 <DIR> d-------- c:\program files\Prevx 2009-04-09 09:55 . 2009-04-09 09:55 22,024 --a------ c:\windows\System32\drivers\pxscan.sys 2009-04-09 09:55 . 2009-04-09 11:14 67 --a------ c:\windows\wininit.ini 2009-04-09 09:45 . 2009-04-09 09:45 <DIR> d-------- c:\program files\Trend Micro 2009-04-07 15:49 . 2009-04-07 15:49 <DIR> d-------- c:\program files\7-Zip 2009-04-06 20:05 . 2009-04-06 20:05 <DIR> d-------- C:\CFLog 2009-04-06 19:50 . 2009-04-06 19:50 <DIR> d-------- c:\program files\G4box 2009-04-03 22:05 . 2009-04-03 22:05 <DIR> d-------- c:\users\Daniel\AppData\Roaming\TuneUp Software 2009-04-03 22:05 . 2009-04-03 22:05 604,416 --a------ c:\windows\System32\TUProgSt.exe 2009-04-03 22:04 . 2009-04-03 22:04 <DIR> d-------- c:\users\All Users\TuneUp Software 2009-04-03 22:04 . 2009-04-03 22:04 <DIR> d-------- c:\programdata\TuneUp Software 2009-04-03 22:03 . 2009-04-03 22:03 <DIR> d--hs---- c:\users\All Users\{55A29068-F2CE-456C-9148-C869879E2357} 2009-04-03 22:03 . 2009-04-03 22:03 <DIR> d--hs---- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357} 2009-04-02 15:38 . 2009-04-06 20:35 <DIR> d-------- c:\program files\MobMapUpdater 2009-04-01 20:43 . 2009-04-01 20:43 <DIR> d-------- c:\program files\Intelore 2009-03-29 16:50 . 2009-03-29 16:50 <DIR> d-------- C:\Temp 2009-03-29 16:49 . 2009-03-29 16:49 <DIR> d-------- c:\program files\Xilisoft 2009-03-26 20:45 . 1998-05-21 11:00 1,081,616 --a------ c:\windows\System32\mscomctl.ocx 2009-03-26 20:45 . 2004-03-09 17:45 152,848 --a------ c:\windows\System32\Comdlg32.ocx 2009-03-26 20:45 . 2006-07-29 02:22 51,712 --a------ c:\windows\System32\coodest.dll 2009-03-26 20:31 . 2009-04-03 21:19 <DIR> d-------- c:\users\Daniel\AppData\Roaming\Teleca 2009-03-26 20:09 . 2007-04-24 12:33 100,488 --a------ c:\windows\System32\drivers\s125mgmt.sys 2009-03-26 20:08 . 2007-04-24 12:33 108,680 --a------ c:\windows\System32\drivers\s125mdm.sys 2009-03-26 20:08 . 2007-04-24 12:33 98,696 --a------ c:\windows\System32\drivers\s125obex.sys 2009-03-26 20:08 . 2007-04-24 12:33 15,112 --a------ c:\windows\System32\drivers\s125mdfl.sys 2009-03-26 20:08 . 2007-04-24 12:33 12,424 --a------ c:\windows\System32\drivers\s125cmnt.sys 2009-03-26 20:08 . 2007-04-24 12:33 12,424 --a------ c:\windows\System32\drivers\s125cm.sys 2009-03-26 20:07 . 2007-04-24 12:33 83,336 --a------ c:\windows\System32\drivers\s125bus.sys 2009-03-26 20:07 . 2007-04-24 12:33 12,424 --a------ c:\windows\System32\drivers\s125whnt.sys 2009-03-26 20:07 . 2007-04-24 12:33 12,424 --a------ c:\windows\System32\drivers\s125wh.sys 2009-03-26 20:03 . 2009-03-26 20:03 <DIR> d-------- c:\users\Daniel\AppData\Roaming\Sony Ericsson 2009-03-26 20:02 . 2009-03-26 20:02 <DIR> d-------- c:\program files\Sony Ericsson 2009-03-26 20:02 . 2009-04-03 21:19 <DIR> d-------- c:\program files\Common Files\Teleca Shared 2009-03-26 19:49 . 2009-03-26 19:50 54,156 --ah----- c:\windows\QTFont.qfn 2009-03-26 19:49 . 2009-03-26 19:50 1,409 --a------ c:\windows\QTFont.for 2009-03-26 19:48 . 2009-04-03 21:19 <DIR> d-------- c:\windows\Downloaded Installations 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Videos 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Searches 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Saved Games 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Pictures 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Music 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Links 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Downloads 2009-03-23 14:25 . 2009-03-23 14:25 <DIR> dr------- c:\windows\System32\config\systemprofile\Documents 2009-03-23 14:14 . 2009-04-03 21:57 <DIR> d-------- c:\program files\VstPlugins 2009-03-23 14:14 . 2009-03-23 14:14 <DIR> d-------- c:\program files\Outsim 2009-03-23 14:14 . 2002-07-08 00:14 1,294,336 --a------ c:\windows\System32\vorbis.acm 2009-03-23 14:14 . 2006-06-20 10:56 225,280 --a------ c:\windows\System32\rewire.dll 2009-03-23 14:12 . 2009-04-03 22:08 <DIR> d-------- c:\program files\Image-Line 2009-03-16 20:50 . 2009-03-16 20:50 <DIR> d-------- C:\.jagex_cache_32 2009-03-15 16:47 . 2009-03-15 16:47 <DIR> d-------- c:\users\All Users\Avira 2009-03-15 16:47 . 2009-03-15 16:47 <DIR> d-------- c:\programdata\Avira 2009-03-15 16:47 . 2009-03-15 16:47 <DIR> d-------- c:\program files\Avira 2009-03-14 13:32 . 2009-02-24 23:13 3,117,818 --a------ c:\windows\System32\GameMon.des 2009-03-14 13:29 . 2003-07-21 05:17 5,174 --a------ c:\windows\System32\nppt9x.vxd 2009-03-14 13:29 . 2005-01-04 20:43 4,682 --a------ c:\windows\System32\npptNT2.sys 2009-03-14 13:28 . 2009-03-14 13:28 <DIR> d-------- c:\program files\Common Files\INCA Shared 2009-03-14 13:05 . 2009-03-14 13:05 <DIR> d-------- c:\program files\Acclaim 2009-03-14 12:23 . 2009-04-06 19:09 <DIR> d-------- c:\users\All Users\PMB Files 2009-03-14 12:23 . 2009-04-06 19:09 <DIR> d-------- c:\programdata\PMB Files 2009-03-14 12:22 . 2009-03-14 12:22 <DIR> d-------- c:\program files\Pando Networks 2009-03-13 22:31 . 2009-03-13 22:31 <DIR> d-------- c:\users\Daniel\WoW-BurningCrusade-deDE-Slim-Installer 2009-03-13 22:00 . 2009-03-13 22:01 <DIR> d-------- c:\program files\Metin2_Germany 2009-03-10 19:44 . 2009-03-10 19:44 104 --a------ c:\windows\LEXSTAT.INI 2009-03-10 19:42 . 2003-02-25 06:52 303,104 --a------ c:\windows\System32\LEXBCES.EXE 2009-03-10 19:42 . 1997-04-08 21:08 299,520 --a------ c:\windows\uninst.exe 2009-03-10 19:42 . 2003-02-25 06:49 201,216 --a------ c:\windows\System32\LEXP2P32.DLL 2009-03-10 19:42 . 2003-02-25 06:54 196,096 --a------ c:\windows\System32\LEX2KUSB.DLL 2009-03-10 19:42 . 2003-02-25 07:10 192,512 --a------ c:\windows\System32\lexlmpm.dll 2009-03-10 19:42 . 2003-02-25 06:50 174,592 --a------ c:\windows\System32\LEXPPS.EXE 2009-03-10 19:42 . 2003-02-25 06:51 147,456 --a------ c:\windows\System32\LEXBCE.DLL 2009-03-10 19:42 . 2003-03-05 18:06 61,440 --a------ c:\windows\System32\lxbcpwr.dll 2009-03-10 19:41 . 2009-03-10 19:41 <DIR> d-------- C:\LXKZ600 . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-09 13:21 162,046 ----a-w c:\users\All Users\nvModes.dat 2009-04-09 13:21 162,046 ----a-w c:\programdata\nvModes.dat 2009-04-09 13:21 --------- d-----w c:\users\Daniel\AppData\Roaming\Skype 2009-04-09 09:41 --------- d-----w c:\users\Daniel\AppData\Roaming\skypePM 2009-04-09 08:15 --------- d--h--w c:\program files\InstallShield Installation Information 2009-04-09 08:14 --------- d---a-w c:\programdata\TEMP 2009-04-09 08:13 --------- d-----w c:\programdata\CyberLink 2009-04-08 11:48 --------- d-----w c:\program files\Common Files\Adobe 2009-04-03 20:10 --------- d-----w c:\program files\Jowood 2009-04-03 20:09 --------- d-----w c:\program files\Google 2009-04-03 19:15 34 ----a-w c:\users\Daniel\jagex_runescape_preferences.dat 2009-03-27 12:37 --------- d-----w c:\program files\DVDVideoSoft 2009-03-27 12:37 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2009-03-23 12:25 --------- d-----w c:\program files\Common Files\InstallShield 2009-03-20 12:36 --------- d-----w c:\users\Daniel\AppData\Roaming\uTorrent 2009-03-15 14:38 --------- d-----w c:\program files\Counter-Strike 1.6 2009-03-13 20:38 --------- d-----w c:\users\Daniel\AppData\Roaming\teamspeak2 2009-03-10 08:16 --------- d-----w c:\program files\ICQ6.5 2009-03-08 13:36 --------- d-----w c:\program files\Launch Manager 2009-03-06 13:21 --------- d-----w c:\program files\DecodingHQ 2009-03-06 12:36 --------- d-----w c:\program files\Opera 2009-02-26 20:10 --------- d-----w c:\users\Daniel\AppData\Roaming\MobMapUpdater 2009-02-26 10:39 --------- d-----w c:\program files\Microsoft Silverlight 2009-02-24 17:17 --------- d-----w c:\program files\World of Warcraft 2009-02-23 16:20 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-02-22 10:42 --------- d-----w c:\programdata\Skype 2009-02-22 10:42 --------- d-----w c:\program files\Common Files\Skype 2009-02-22 10:42 --------- d-----r c:\program files\Skype 2009-02-22 09:57 --------- d-----w c:\program files\Teamspeak2_RC2 2009-02-20 13:41 --------- d-----w c:\users\Daniel\AppData\Roaming\Leadertech 2009-02-19 13:34 --------- d-----w c:\programdata\NVIDIA 2009-02-17 14:16 --------- d-----w c:\program files\GameSpy Arcade 2009-02-16 14:07 --------- d-----w c:\users\Daniel\AppData\Roaming\GetRightToGo 2009-02-13 14:41 --------- d-----w c:\users\Daniel\AppData\Roaming\ICQ 2009-02-12 13:52 --------- d-----w c:\program files\Windows Mail 2009-02-02 13:53 66,872 ----a-w c:\windows\System32\PnkBstrA.exe 2009-02-02 13:53 22,328 ----a-w c:\users\Daniel\AppData\Roaming\PnkBstrK.sys 2009-02-02 13:53 2,250,024 ----a-w c:\windows\System32\pbsvc.exe 2009-02-02 13:53 107,832 ----a-w c:\windows\System32\PnkBstrB.exe 2009-01-18 10:19 0 ----a-w c:\users\Daniel\AppData\Roaming\wklnhst.dat 2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll 2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini 2008-12-17 22:34 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-17 22:34 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-17 22:34 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-17 22:34 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-17 22:34 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-14 17:05 121392 --a------ c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "MobMapUpdater"="c:\program files\MobMapUpdater\MobMapUpdater.exe" [2009-04-06 1771648] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-02-04 23975720] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-13 1033512] "PLFSetI"="c:\windows\PLFSetI.exe" [2008-06-30 200704] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-16 821768] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-17 13552160] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-17 92704] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-03-05 147456] "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-03-18 173352] "RtHDVCpl"="RtHDVCpl.exe" [2008-05-20 c:\windows\RtHDVCpl.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeDeluxeAgent] --------- 2008-03-05 16:55 147456 c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BkupTray] --a------ 2008-04-25 21:36 28672 c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer] --------- 2009-03-18 10:43 173352 c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-12-10 11:02 216520 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC] --a------ 2008-05-09 14:07 397312 c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlayMovie] --------- 2008-03-04 22:21 167936 c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProductReg] --a------ 2008-09-23 06:53 6144 c:\program files\Acer\WR_PopUp\ProductReg.exe |
|
09.04.2009, 14:37
| #5 |
| | Windows Updates Funktionieren nicht und andere Updates. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2009-01-08 17:29 136600 c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{230B3936-A5F0-41D5-95B2-7D8E8A08ACEF}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{732D98B5-658B-45BD-BDE2-65345664786E}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{CC8F1DA4-9A50-4F91-B095-D18787D5B7E7}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{D98861E1-7A13-4FFE-B4EC-F1E0CE8D184A}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{C0167C73-06A6-4B1F-9968-0E1BC76D1876}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{8508037C-ABA3-478C-8EE9-FDDDD52358F0}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{1FF27181-BD41-4110-92AF-E44346E6BEB1}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{38B38DC0-8A70-422B-AC7E-F53EEBAC0FEF}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{B2E07B66-652C-495F-8183-B9EDC7FBDEB1}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{3014518C-100D-4764-AAAD-5935F5F4466E}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe "{6658553D-B994-4E7A-A618-5F8E262CCEF1}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie "{22940BC3-AF6C-49A6-A658-14B8C2FA395D}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program "{D219240B-27E0-4242-94EB-ACD5F26E00F4}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia "{52EFF66E-B0E3-4A63-9B3B-485471FFC6F9}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{37FDEA82-9532-48C5-AA97-EEC5EC1AFC42}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{29A4C851-308C-4A13-B472-C4EC508C0E71}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{BFB4E525-0BCE-4D6A-AA0B-DA5F3EC7BA1A}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser "UDP Query User{77CCA882-675A-4432-A7FB-270BDE0683FA}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser "TCP Query User{184D7C68-BD36-4F6A-9D38-FE59F4DC9666}c:\\program files\\jowood\\chaser\\chaser.exe"= UDP:c:\program files\jowood\chaser\chaser.exe:Chaser "UDP Query User{3AD5D30B-0681-44E1-A029-23020171DAA8}c:\\program files\\jowood\\chaser\\chaser.exe"= TCP:c:\program files\jowood\chaser\chaser.exe:Chaser "TCP Query User{A0D16DA7-9E9B-4645-B36A-4C6C7CE7044A}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent "UDP Query User{242904E8-5539-43F8-A42B-4D577039C60A}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent "TCP Query User{424E38CF-1F3F-4FF7-879E-E99893F1F3C0}c:\\users\\daniel\\downloads\\unrealtournamenthq\\unrealtournamenthq\\system\\unrealtournament.exe"= UDP:c:\users\daniel\downloads\unrealtournamenthq\unrealtournamenthq\system\unrealtournament.exe:unrealtournament.exe "UDP Query User{6AFB28B5-0300-4ABF-AD0E-8E0E4C4BCA55}c:\\users\\daniel\\downloads\\unrealtournamenthq\\unrealtournamenthq\\system\\unrealtournament.exe"= TCP:c:\users\daniel\downloads\unrealtournamenthq\unrealtournamenthq\system\unrealtournament.exe:unrealtournament.exe "TCP Query User{BB3DDC93-6D5B-4F05-8B04-993F6D7A2ED8}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser "UDP Query User{249FC5B9-F5E5-412B-B183-0A7EE0373116}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser "TCP Query User{3D198845-DD22-4E5D-BDAC-F17E650915E3}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{12D1A4C7-18A3-4981-B56B-8CB6D80326CE}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "TCP Query User{41EFD125-2CE9-4D82-9F6B-05CBE94601B4}c:\\program files\\metin2_germany\\metin2.bin"= UDP:c:\program files\metin2_germany\metin2.bin:metin2.bin "UDP Query User{CE5B53B5-CD6E-476B-A462-151D72234766}c:\\program files\\metin2_germany\\metin2.bin"= TCP:c:\program files\metin2_germany\metin2.bin:metin2.bin "TCP Query User{76D65F34-A5CD-43A8-8102-648CCAEC4421}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{1BBE3938-84BF-4CCD-A890-4B81E6F398AB}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "{0A5CC08C-BD59-4402-9F2F-C3F2DE1AE5BD}"= UDP:64347:BitComet 64347 TCP "{5E2966F6-DD36-4100-A8AF-BDC416BB14AA}"= TCP:64347:BitComet 64347 UDP "{40DF1F51-246D-425F-A97D-9A5B24738B2B}"= UDP:59999:BitComet 59999 TCP "{AFCC56D8-4736-4489-B730-F91B6BB48C96}"= TCP:59999:BitComet 59999 UDP "{F9D3E167-5184-4780-9AA2-8D1D7311B0ED}"= UDP:59999:BitComet 59999 TCP "{2DD86CDD-EDB6-4A00-BBE9-A6F46C2E14FD}"= TCP:59999:BitComet 59999 UDP "{9F715948-51E9-4221-A218-40B7B733D16D}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.1-to-3.0.2-deDE-Win-Update-downloader.exe:Blizzard Downloader "{364FD039-8E21-4161-B8EF-93CCE466AE74}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.1-to-3.0.2-deDE-Win-Update-downloader.exe:Blizzard Downloader "{BD590732-41F9-43D0-9829-012C52DF56BC}"= UDP:3724:Blizzard Downloader: 3724 "{10066E7C-2B42-4EF4-90AD-3AF872446557}"= UDP:d:\program files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe:S.T.A.L.K.E.R. - Clear Sky (CLI) "{CC863680-B545-4286-BFC6-F4391C847403}"= TCP:d:\program files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe:S.T.A.L.K.E.R. - Clear Sky (CLI) "{4FD991E6-6C36-4713-B1F9-2928CEE7AD54}"= UDP:d:\program files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe:S.T.A.L.K.E.R. - Clear Sky (SRV) "{260C54AA-38D8-425B-8CB5-492D2F885781}"= TCP:d:\program files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe:S.T.A.L.K.E.R. - Clear Sky (SRV) "{0FFD8C73-66E1-4E91-9DB8-1ED0779C7469}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{D83D446E-8125-4163-B879-225156DBE073}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{83A9B443-ACE8-43E2-93B5-B3DCDA030098}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{8D04DCA0-6EB7-4A0D-A252-0C787E716CEC}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "TCP Query User{DB19CD93-1EEE-4281-A211-2549CA2385A1}c:\\program files\\jowood\\chaser\\chaser -console.exe"= UDP:c:\program files\jowood\chaser\chaser -console.exe:Chaser "UDP Query User{AAB47163-A132-4065-96F9-1DCB9B19730A}c:\\program files\\jowood\\chaser\\chaser -console.exe"= TCP:c:\program files\jowood\chaser\chaser -console.exe:Chaser "TCP Query User{A67C0AEB-5A56-49C0-A62F-586B1410C961}c:\\program files\\left4dead\\hl2.exe"= UDP:c:\program files\left4dead\hl2.exe:hl2 "UDP Query User{8B8C7AB7-00DD-4AF1-A9A6-F55DE32CBB53}c:\\program files\\left4dead\\hl2.exe"= TCP:c:\program files\left4dead\hl2.exe:hl2 "{ADA3389B-A1C1-44AE-AB5B-2B89767AEEF2}"= UDP:19843:BitComet 19843 TCP "{9EA67F0E-545F-4390-97AA-9AA357E5C27C}"= TCP:19843:BitComet 19843 UDP "{799D46C2-C150-4517-AFB9-F84EA5FF4225}"= UDP:19843:BitComet 19843 TCP "{CA89A5CB-23E0-48DA-8B00-18E26DA01D88}"= TCP:19843:BitComet 19843 UDP "{5B22691B-C230-4149-B94F-1716D7FE0C36}"= UDP:27727:BitComet 27727 TCP "{7B8FC8E2-F00D-40B9-BD5E-31A894A363CC}"= TCP:27727:BitComet 27727 UDP "{575B7FFC-0514-4502-9C11-E0FEA6AAE111}"= UDP:27727:BitComet 27727 TCP "{081629A7-F5F2-4202-BFD7-EC6817868659}"= TCP:27727:BitComet 27727 UDP "TCP Query User{52EEB252-D0AB-4FC0-884A-9CB3714F681F}c:\\users\\daniel\\downloads\\wwp\\wwp\\wp.exe"= UDP:c:\users\daniel\downloads\wwp\wwp\wp.exe:wp.exe "UDP Query User{7C7F0DCB-FF7A-4015-B053-FC51CA44B970}c:\\users\\daniel\\downloads\\wwp\\wwp\\wp.exe"= TCP:c:\users\daniel\downloads\wwp\wwp\wp.exe:wp.exe "TCP Query User{CED94AEC-CAA2-468D-BA98-31AC538AC3AB}c:\\program files\\teamspeak2_rc2\\server_windows.exe"= UDP:c:\program files\teamspeak2_rc2\server_windows.exe:Server "UDP Query User{63D077E1-2275-4ACF-B302-E593FBAC9B19}c:\\program files\\teamspeak2_rc2\\server_windows.exe"= TCP:c:\program files\teamspeak2_rc2\server_windows.exe:Server "{D5DE3440-009E-4848-890E-334CA1141B9B}"= c:\program files\Skype\Phone\Skype.exe:Skype "{B378B624-B2EE-4B0F-A255-7A664C3F19DE}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-deDE-Win-Final-downloader.exe:Blizzard Downloader "{3B28149A-92C3-477A-ABC8-478F133FEE34}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-deDE-Win-Final-downloader.exe:Blizzard Downloader "TCP Query User{D2AF3104-50C6-4914-A717-A2336D83D2FD}c:\\program files\\world of warcraft\\launcher.exe"= UDP:c:\program files\world of warcraft\launcher.exe:Blizzard Launcher "UDP Query User{6E11D978-4BC5-400A-A7D0-60EF420449B5}c:\\program files\\world of warcraft\\launcher.exe"= TCP:c:\program files\world of warcraft\launcher.exe:Blizzard Launcher "{FA0CA805-3BDF-4E9C-87FD-ABA26A9EF8AA}"= UDP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster "{641342CB-49DE-4CFC-98ED-E45566D219E2}"= TCP:c:\program files\Pando Networks\Media Booster\PMB.exe:Pando Media Booster [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "DoNotAllowExceptions"= 0 (0x0) R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-12-24 15:07:02 41456] R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-12-24 81504] R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-04-09 4414520] R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-04-01 24576] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-25 45056] R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-12-24 122368] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-25 131072] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [2008-04-01 210432] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [2008-07-23 44064] R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [2007-03-28 43008] S3 Ltn_stk7070P;PCTV LITEON based TV tuner device;c:\windows\System32\drivers\Ltn_stk7070P.sys [2008-04-01 542976] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\System32\drivers\Ph3xIB32.sys [2007-04-03 1131136] S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\System32\drivers\s125bus.sys [2009-03-26 83336] S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\System32\drivers\s125mdfl.sys [2009-03-26 15112] S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\System32\drivers\s125mdm.sys [2009-03-26 108680] S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s125mgmt.sys [2009-03-26 100488] S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;c:\windows\System32\drivers\s125obex.sys [2009-03-26 98696] S3 WSVD;WSVD;c:\windows\System32\drivers\WSVD.sys [2008-12-24 75776] S4 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3de8c0ef-d2aa-11dd-92c0-00238b19b58a}] \shell\AutoRun\command - G:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72f1354c-d502-11dd-b019-00238b19b58a}] \shell\AutoRun\command - F:\FalloutLauncher.exe . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.ask.com/?o=13166&l=dis mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g IE: &Alles mit BitComet herunterladen - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Alle &Videos mit BitComet herunterladen - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Mit BitComet herunter&laden - c:\program files\BitComet\BitComet.exe/AddLink.htm FF - ProfilePath - ---- FIREFOX Richtlinien ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?"); . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-09 15:28:21 Windows 6.0.6001 Service Pack 1 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . Zeit der Fertigstellung: 2009-04-09 15:30:47 ComboFix-quarantined-files.txt 2009-04-09 13:30:44 Vor Suchlauf: 27 Verzeichnis(se), 70.951.923.712 Bytes frei Nach Suchlauf: 27 Verzeichnis(se), 71,714,844,672 Bytes frei 336 --- E O F --- 2009-03-06 12:21:07 |
|
09.04.2009, 14:49
| #6 |
| | Windows Updates Funktionieren nicht und andere Updates. Hi, was sagt MAM...? Bitte folgende Files prüfen: Dateien Online überprüfen lassen:
Code:
ATTFilter c:\windows\QTFont.qfn
Gmer: http://www.trojaner-board.de/74908-a...t-scanner.html Starte GMER und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. ist dieser beendet, wähle Copy und füge den Bericht ein. SilentRunner: Ziparchive in ein Verzeichnis auspacken, mit Doppelklick starten, "ja" auswählen. Die erstellte Datei findet sich im gleichen Verzeichnis wo das Script hinkopiert wurde, bitte in Editor laden und posten. http://www.silentrunners.org/Silent%20Runners.zip chris Ps.: Ich frage mich, wo sind die Treiber des Rootkits abgeblieben... c:\windows\system32\gaopdxcounter
__________________ --> Windows Updates Funktionieren nicht und andere Updates. Geändert von Chris4You (09.04.2009 um 15:04 Uhr) |
|
09.04.2009, 14:58
| #7 |
| | Windows Updates Funktionieren nicht und andere Updates. Antivirus Version letzte aktualisierung Ergebnis a-squared 4.0.0.101 2009.04.09 - AhnLab-V3 5.0.0.2 2009.04.09 - AntiVir 7.9.0.138 2009.04.09 - Antiy-AVL 2.0.3.1 2009.04.09 - Authentium 5.1.2.4 2009.04.08 - Avast 4.8.1335.0 2009.04.08 - AVG 8.5.0.285 2009.04.09 - BitDefender 7.2 2009.04.09 - CAT-QuickHeal 10.00 2009.04.09 - ClamAV 0.94.1 2009.04.09 - Comodo 1107 2009.04.09 - DrWeb 4.44.0.09170 2009.04.09 - eSafe 7.0.17.0 2009.04.07 - eTrust-Vet 31.6.6447 2009.04.09 - F-Prot 4.4.4.56 2009.04.08 - F-Secure 8.0.14470.0 2009.04.09 - Fortinet 3.117.0.0 2009.04.09 - GData 19 2009.04.09 - Ikarus T3.1.1.49.0 2009.04.09 - K7AntiVirus 7.10.697 2009.04.08 - Kaspersky 7.0.0.125 2009.04.09 - McAfee 5578 2009.04.08 - McAfee+Artemis 5578 2009.04.08 - McAfee-GW-Edition 6.7.6 2009.04.09 - Microsoft 1.4502 2009.04.09 - NOD32 3997 2009.04.09 - Norman 6.00.06 2009.04.09 - nProtect 2009.1.8.0 2009.04.09 - Panda 10.0.0.14 2009.04.08 - PCTools 4.4.2.0 2009.04.08 - Prevx1 V2 2009.04.09 - Rising 21.24.32.00 2009.04.09 - Sophos 4.40.0 2009.04.09 - Sunbelt 3.2.1858.2 2009.04.09 - Symantec 1.4.4.12 2009.04.09 - TheHacker 6.3.4.0.305 2009.04.09 - TrendMicro 8.700.0.1004 2009.04.09 - VBA32 3.12.10.2 2009.04.09 - ViRobot 2009.4.7.1686 2009.04.09 - VirusBuster 4.6.5.0 2009.04.09 - weitere Informationen File size: 54156 bytes MD5...: dba91cd5a3a68302967c03213e52bde8 SHA1..: 8188a5832590c810b08ee3a2f1567afcdd094108 SHA256: 1a355634a47a01ce03e05328c2835a86926818bacdcb663db2136d691319dd18 SHA512: c1afd1304fca65d1bd39a43fad5dc7a6c8528c225a019012163dde2948b82455 c2616e27db2c03c03ac85e5c7dff77286688aea75b2355e5dce3c71c78526f94 ssdeep: 768:PSQ/EPXqsiVDQzbwaZ2QxDWNXVeOwMxsdy4uGiRu2beVopjRsFkrb8Q++J/+ aSq:m6 PEiD..: - TrID..: File type identification TrueType Font (100.0%) PEInfo: - RDS...: NSRL Reference Data Set - |
|
09.04.2009, 15:05
| #8 |
| | Windows Updates Funktionieren nicht und andere Updates. Wie starte ich Gmer? |
|
09.04.2009, 15:07
| #9 |
| | Windows Updates Funktionieren nicht und andere Updates. "Silent Runners.vbs", revision 59, http://www.silentrunners.org/ Operating System: Windows Vista Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ehTray.exe" = "C:\Windows\ehome\ehTray.exe" [MS] "MobMapUpdater" = ""C:\Program Files\MobMapUpdater\MobMapUpdater.exe" --silent" [null data] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "WMPNSCFG" = "C:\Program Files\Windows Media Player\WMPNSCFG.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "RtHDVCpl" = "RtHDVCpl.exe" ["Realtek Semiconductor"] "eDataSecurity Loader" = "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" ["Egis Incorporated"] "eAudio" = ""C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"" ["Acer Incorporated"] "SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."] "PLFSetI" = "C:\Windows\PLFSetI.exe" [empty string] "LManager" = "C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE Systemboot" ["Dritek System Inc."] "NvCplDaemon" = "RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup" [MS] "NvMediaCenter" = "RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit" [MS] "avgnt" = ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] "Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"] "ArcadeDeluxeAgent" = ""C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"" ["CyberLink Corp."] "CLMLServer" = ""C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"" ["CyberLink"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++} "Malwarebytes' Anti-Malware" = "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent" ["Malwarebytes Corporation"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll" ["BitComet"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ["Sun Microsystems, Inc."] {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}\(Default) = (no title provided) -> {HKLM...CLSID} = "ShowBarObj Class" \InProcServer32\(Default) = "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll" ["Egis"] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll" ["Google Inc."] {DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0}" = "EPM-PO Shell Extension" -> {HKLM...CLSID} = "EPM-PO Shell Extensions" \InProcServer32\(Default) = "epm-po.dll" [file not found] "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" = "eDS psd drag drop protection" -> {HKLM...CLSID} = "DragDropProtect Class" \InProcServer32\(Default) = "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll" ["Egis Inc."] "{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Meine freigegebenen Ordner" \InProcServer32\(Default) = "C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll" [MS] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9}" = "NVIDIA Play On My TV Context Menu Extension" -> {HKLM...CLSID} = "NVIDIA CPL Context Menu Extension" \InProcServer32\(Default) = "C:\Windows\system32\nvshext.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] EDSshellExt\(Default) = "{29FF7AB0-BE34-4992-A30B-53A9D86EE239}" -> {HKLM...CLSID} = "eDSshlExt Class" \InProcServer32\(Default) = "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSshellExt.dll" ["Egis Incorporated."] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] EDSshellExt\(Default) = "{29FF7AB0-BE34-4992-A30B-53A9D86EE239}" -> {HKLM...CLSID} = "eDSshlExt Class" \InProcServer32\(Default) = "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSshellExt.dll" ["Egis Incorporated."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}" -> {HKLM...CLSID} = "MBAMShlExt Class" \InProcServer32\(Default) = "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}" -> {HKLM...CLSID} = "MBAMShlExt Class" \InProcServer32\(Default) = "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "ConsentPromptBehaviorAdmin" = (REG_DWORD) dword:0x00000002 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode} "ConsentPromptBehaviorUser" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Behavior Of The Elevation Prompt For Standard Users} "EnableInstallerDetection" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Detect Application Installations And Prompt For Elevation} "EnableLUA" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Run All Administrators In Admin Approval Mode} "EnableSecureUIAPaths" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Only elevate UIAccess applications that are installed in secure locations} "EnableVirtualization" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Virtualize file and registry write failures to per-user locations} "PromptOnSecureDesktop" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Switch to the secure desktop when prompting for elevation} "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "FilterAdministratorToken" = (REG_DWORD) dword:0x00000000 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| User Account Control: Admin Approval Mode for the Built-in Administrator Account} "EnableUIADesktopToggle" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Users\Daniel\AppData\Roaming\Opera\Opera\profile\skin\Audi-A4_Avant_32spiegelung.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ LightScribeOnArrivalAP\ "Provider" = "LightScribe Direct Disc Labeling" "InvokeProgID" = "LightScribe.AutoPlayHandler" "InvokeVerb" = "LabelLightScribeDisc" HKLM\SOFTWARE\Classes\LightScribe.AutoPlayHandler\shell\LabelLightScribeDisc\command\(Default) = "C:\Program Files\Common Files\LightScribe\LsLauncher.exe" ["Hewlett-Packard Company"] MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["mpc-hc@Sourceforge"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["mpc-hc@Sourceforge"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"] |
|
09.04.2009, 15:15
| #11 | |
| | Windows Updates Funktionieren nicht und andere Updates. Hi, nichts mehr zu sehen... Zu Gmer: Oben rechts findest Du einen Button zum downloade auf der Page, dabei ändert sich der Name von Gmer (damit eventuell aktive Rootkits den Start nicht unterbinden können). Daher musst Du Dir den Pfad und den App-Namen merken, dann Doppelklick und er sollte hochfahren. Verfahre wie unter dem Link http://www.trojaner-board.de/74908-a...t-scanner.html beschrieben weiter. Achtung Falls GMER nicht starten kann, bitte folgendes prüfen: Arbeitsplatz->rechte Maustaste->Eigenschaften->Hardware->Gerätemanager->Ansicht->ausgeblendete Geräte anzeigen->Nicht PnP-Treiber und dort den Treiber "TDSSserv.sys", "UACd.sys" (z. B.: UACjkrpwvvu.dll etc.) oder aehnlich deaktivieren und neu starten. Falls Du dort nichts findest wird es interessant... Dann brauchen wir noch eine Überprüfung des Bootblockes: MBR-Rootkit Lade den MBR-Rootkitscanner von GMER auf Deine Bootplatte: http://www2.gmer.net/mbr/mbr.exe Merke Dir das Verzeichnis wo Du ihn runtergeladen hast; Start->Ausführen->cmd Wechsle in das Verzeichnis des Downloads und starte durch Eingabe von mbr das Programm... Das Ergebnis sollte so aussehen: Zitat:
poste es im Thread; Was macht das MAM-Log? chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) Geändert von Chris4You (09.04.2009 um 15:21 Uhr) |
|
09.04.2009, 15:21
| #12 |
| | Windows Updates Funktionieren nicht und andere Updates. Sry ich glaub ich bin Blind  kannst du es Rapidshare oder Ähnl. Uppen? |
|
09.04.2009, 15:25
| #13 |
| | Windows Updates Funktionieren nicht und andere Updates. Ich muss jetzt leider Wegfahren .Können wir morgen oder Heute abend Weiter machen? Mfg ddanieldd bis ???? |
|
09.04.2009, 15:25
| #14 |
| | Windows Updates Funktionieren nicht und andere Updates. Hi, hier Gmer: http://www.file-upload.net/download-...q5t69.exe.html chris Ps.: Mal sehen ob ich heute Abend noch Zeit habe, poste einfach und wenn sich länger nichts tut bitte redwulf ansprechen... Wenn GMER aber nichts findet oder nicht startet, dann können wir noch ein paar andere Rootkitscanner ausprobieren, müssen dann aber von Rettungs-CD aus vorgehen... Ich denke das uns RSIT oder etwas ähnliches nicht weiterhelfen wird...
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) Geändert von Chris4You (09.04.2009 um 15:30 Uhr) |
|
09.04.2009, 20:09
| #15 |
| | Windows Updates Funktionieren nicht und andere Updates. Wie lange Dauert es mit demm Malwarebyte ca? Geändert von ddanieldd (09.04.2009 um 20:18 Uhr) |
|
| Themen zu Windows Updates Funktionieren nicht und andere Updates. |
| adobe, antivirus, avg, avira, bho, defender, dll, explorer, funktionieren nicht, google, hijack, hijackthis, internet, internet explorer, launch, local\temp, nvidia, object, opera, plug-in, rundll, seiten, software, system, temp, updates, vista, windows, windows defender, windows sidebar, windows updates |
Linear-Darstellung
