| |
| |||||||
Log-Analyse und Auswertung: G-data 18 viren in quarantäneWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
28.10.2009, 16:28
| #1 |
| |  G-data 18 viren in quarantäne hallo zusammen. bin ein ziemlicher Laie wenns um computer geht. hab FRÜHER recht viele dateien runtergeladen und mir wohl einiges eingefangen. Wär dankbar wenn mir jemand n tip geben könnte was ich machen kann. vielen dank im vorraus link zum screenshot von g-data quarantäne h**p://www.abload.de/image.php?img=magicalsnap-2009.10.28lvj6.png Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:16:09, on 28.10.2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18828) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\hp\support\hpsysdrv.exe C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe C:\Program Files\G DATA AntiVirus\AVKTray\AVKTray.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe C:\Windows\RtHDVCpl.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\wuauclt.exe C:\PROGRA~1\GDATAA~1\AVK\avk.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Ashampoo\Ashampoo Magical Snap 2\ashsnap.exe C:\Program Files\ICQ6.5\ICQ.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.computerbild.de/ie8/start R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.os-community.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Presario&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer bereitgestellt von COMPUTERBILD R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll O1 - Hosts: ::1 localhost O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA AntiVirus\Webfilter\AVKWebIE.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0744.0\msneshellx.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: kikin Plugin - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA AntiVirus\Webfilter\AVKWebIE.dll O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0744.0\msneshellx.dll O3 - Toolbar: Recorder Toolbar - {120A8821-2BEE-4C29-BCDA-62C577781992} - C:\Program Files\MedienTeam66\MP3 Recorder for YouTube\IEPlugin.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O3 - Toolbar: FireShot - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Program Files\FireShot for IE\fsaddin-0.76.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA AntiVirus\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [Firefox] C:\Program Files\Mozilla Firefox\firefox.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: hpoddt01.exe.lnk = ? O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Download Video - http://www.viloader.net/addon.htm O9 - Extra button: (no name) - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll O9 - Extra 'Tools' menuitem: My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll O9 - Extra button: SecretCity 3DChat - {D401C3A2-12EF-4D1D-A086-F3AB10B565BF} - C:\PROGRA~1\SECRET~1\\SECRET~1.EXE O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programs\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing) O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Program Files\G DATA AntiVirus\AVK\AVKService.exe O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA AntiVirus\AVK\AVKWCtl.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: O&O DriveLED Service (O&O DriveLED) - O&O Software GmbH - C:\Program Files\OO Software\DriveLED\oodlag.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- End of file - 10559 bytes vielen dank im vorraus |
|
28.10.2009, 17:10
| #2 | ||
  |  G-data 18 viren in quarantäne Moin und
__________________ Zitat:
Werden auf einem System Crackz oder Keygens verwendet ist es eigentlich immer das selbe Lied, die Dinger sind zu 90% verseucht... Zitat:
Neuinstallation => http://www.trojaner-board.de/51262-a...sicherung.html MFG
__________________ |
|
28.10.2009, 18:51
| #3 |
| | G-data 18 viren in quarantäne danke erstmal für die schnelle antwort.
__________________hab trotz der viren eigentlich keine probleme mit meinem rechner. Kann ich auch lassen wie es ist, ohne neu aufzusetzen? sind ja schließlich alle in quarantäne? neu aufsetzen: hab den rechner mit vista vorinstalliert (nicht illegal runtergeladen,  gekauft allerdings keine vista DVD oder produktschlüssel den ich ja laut der anweisung in deinem link zur Neuinstallation brauche. was tun? |
|
28.10.2009, 20:03
| #4 | ||||
| | G-data 18 viren in quarantäne Hallo Zitat:
Zitat:
Zitat:
Ich nicht Zitat:
Damit würde der Rechner auf den Auslieferungszustand zurückgesetzt (kommt einer Neuinstallation gleich). Oder ist dir kein Datenträger beim Verkauf ausgehändigt worden? MFG
__________________ Kein Support per PN - Bitte im Forum posten. Wenn du das Forum unterstützen möchtest Genitiv ins Wasser, weil es dativ ist   http://www.vivaconagua.org/ |
|
28.10.2009, 20:20
| #5 |
| | G-data 18 viren in quarantäne ne, ich hab keine recovery DVD/CD. was tun? welches risiko besteht denn noch wenn mein rechner lasse wie er ist, mit eventueller malware? hab auch schon spybot, search & destroy, a-squared free und Malwarebytes' anti malware eingesetzt. aber das bringt auch nicht wirklich was wenn ich mich richtig erkundigt habe, oder? |
|
29.10.2009, 18:08
| #6 | ||
| | G-data 18 viren in quarantäne Hallo Zitat:
Was machst du bei einem Festplattencrash? Zitat:
 .Überprüfe dein System mal mit GMER und poste das Log hierher, dann kann man evtl. mehr sagen. MFG
__________________ --> G-data 18 viren in quarantäne |
|
01.11.2009, 12:25
| #7 |
| | G-data 18 viren in quarantäne guten tag! (sorry, hat etwas länger gedauert) so bitte: GMER 1.0.15.14966 - http://www.gmer.net Rootkit scan 2009-11-01 12:09:50 Windows 6.0.6002 Service Pack 2 ---- System - GMER 1.0.15 ---- INT 0x51 ? 84489BF8 INT 0x51 ? 84489BF8 INT 0x51 ? 86097F00 INT 0x51 ? 84489BF8 INT 0x61 ? 86097F00 INT 0x82 ? 86097F00 INT 0x92 ? 86097F00 INT 0xA2 ? 84489BF8 INT 0xB2 ? 84489BF8 ---- Kernel code sections - GMER 1.0.15 ---- ? System32\Drivers\spdb.sys Das System kann den angegebenen Pfad nicht finden. ! PAGE ataport.SYS!DllUnload 826B2B2E 5 Bytes JMP 844891D8 .text USBPORT.SYS!DllUnload 8C5CD41B 5 Bytes JMP 860974E0 .text afen0fih.SYS 87FB6000 22 Bytes [82, 93, 3C, 82, 6C, 92, 3C, ...] .text afen0fih.SYS 87FB6017 45 Bytes [00, 32, 37, 7A, 80, 3D, 35, ...] .text afen0fih.SYS 87FB6045 135 Bytes [FA, 0A, 82, FD, 79, 04, 82, ...] .text afen0fih.SYS 87FB60CE 10 Bytes [00, 00, 00, 00, 00, 00, 02, ...] .text afen0fih.SYS 87FB60DA 12 Bytes [00, 00, 02, 00, 00, 00, 24, ...] .text ... ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\a-squared Free\a2service.exe[2008] kernel32.dll!CreateThread + 1A 7769C928 4 Bytes CALL 0045495D C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH) ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [806996D6] \SystemRoot\System32\Drivers\spdb.sys IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [80699042] \SystemRoot\System32\Drivers\spdb.sys IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [80699800] \SystemRoot\System32\Drivers\spdb.sys IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [806990C0] \SystemRoot\System32\Drivers\spdb.sys IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8069913E] \SystemRoot\System32\Drivers\spdb.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [806A8E9C] \SystemRoot\System32\Drivers\spdb.sys IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortNotification] CC358B04 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortWritePortUchar] 8387FDBF IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortWritePortUlong] 458B38C6 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortGetPhysicalAddress] A5A5A514 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 100D8BA5 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortGetScatterGatherList] 5F87FD90 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortReadPortUchar] 30810889 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortStallExecution] 54771129 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortGetParentBusType] 10C25D5E IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortRequestCallback] 8B55CC00 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 084D8BEC IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 0CF0918B IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortCompleteRequest] 458B0000 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortMoveMemory] 8B108910 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 000CF491 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 04508900 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 053C7980 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortReadPortUshort] 560C558B IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortReadPortBufferUshort] C6127557 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortInitialize] B18D0502 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortGetDeviceBase] 00000CF8 IAT \SystemRoot\System32\Drivers\afen0fih.SYS[ataport.SYS!AtaPortDeviceStateChange] A508788D ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\a-squared Free\a2service.exe[2008] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH) IAT C:\Program Files\a-squared Free\a2service.exe[2008] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [745E7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7463A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [745EBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [745DF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [745E75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [745DE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74618395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [745EDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [745DFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [745DFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [745D71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7466CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7460C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [745DD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [745D6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [745D687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[3008] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [745E2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 84E1C1F8 AttachedDevice \FileSystem\Ntfs \Ntfs OODrvled.sys (O&O DriveLED Filter Driver (Win32)/O&O Software GmbH) Device \Driver\volmgr \Device\VolMgrControl 8448B1F8 Device \Driver\usbuhci \Device\USBPDO-0 84F991F8 Device \Driver\usbuhci \Device\USBPDO-1 84F991F8 Device \Driver\usbuhci \Device\USBPDO-2 84F991F8 Device \Driver\usbuhci \Device\USBPDO-3 84F991F8 Device \Driver\usbehci \Device\USBPDO-4 8603D1F8 Device \Driver\volmgr \Device\HarddiskVolume1 8448B1F8 AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group) Device \Driver\volmgr \Device\HarddiskVolume2 8448B1F8 AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group) Device \Driver\cdrom \Device\CdRom0 8610B500 Device \Driver\cdrom \Device\CdRom1 8610B500 Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-2 84E1B1F8 Device \Driver\atapi \Device\Ide\IdePort0 84E1B1F8 Device \Driver\atapi \Device\Ide\IdePort1 84E1B1F8 Device \Driver\atapi \Device\Ide\IdePort2 84E1B1F8 Device \Driver\atapi \Device\Ide\IdePort3 84E1B1F8 Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-4 84E1B1F8 Device \Driver\netbt \Device\NetBt_Wins_Export 86894500 Device \Driver\PCI_PNP8908 \Device\0000004a spdb.sys Device \Driver\netbt \Device\NetBT_Tcpip_{DD88E086-B588-4336-9C52-11E7F5696C56} 86894500 Device \Driver\Smb \Device\NetbiosSmb 867C8500 Device \Driver\iScsiPrt \Device\RaidPort0 860F92D8 Device \Driver\usbuhci \Device\USBFDO-0 84F991F8 Device \Driver\usbuhci \Device\USBFDO-1 84F991F8 Device \Driver\sptd \Device\220566916 spdb.sys Device \Driver\usbuhci \Device\USBFDO-2 84F991F8 Device \Driver\usbuhci \Device\USBFDO-3 84F991F8 Device \Driver\usbehci \Device\USBFDO-4 8603D1F8 Device \Driver\afen0fih \Device\Scsi\afen0fih1Port5Path0Target0Lun0 86049408 Device \Driver\afen0fih \Device\Scsi\afen0fih1 86049408 Device \FileSystem\cdfs \Cdfs A3044500 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB8 0x01 0x35 0x82 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1F 0xD0 0xCE 0x7E ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xC4 0x0B 0x25 0xDF ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEF 0xB4 0x1E 0x3A ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB8 0x01 0x35 0x82 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1F 0xD0 0xCE 0x7E ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xC4 0x0B 0x25 0xDF ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEF 0xB4 0x1E 0x3A ... Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODLED3.00.02.01WSSV F9458F0AABF42B405021B02800DF6CDCAE58AB7EADC5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980 AC7933C038D530D6EB3452A6A0AC4980AC7933C038D530D6EB34529E7C9E4ECB06FD2A144EAC567FF551883DC45F44D31B910BF805FBB1C42B13C9528266A7880548CD8F5237E84482409A 12059FBA195DF14B06151CCFF8ABD83C67EB7B3452E2E245CAE6305605EAAB0585FDF893AC4B08B81B6E54DDBBDFE72BFB76C06C601A78AA182CD582BBDC2B98C053A8BAEFE3FD7DD4D07C 70743514B9C527CC2EBDAA2BBA63851CB1BA0ACECB82689CFD17A76B6868C2A2FDD99E27AF8BC2EAB749198F56A81C2B8CA32517B79DE57B0F2C9A616C1C8F88E17C92DA79AB56982EB4EC AE8179DADD226F69FB1B76BA9C858949E1224B44A35D3C0CE1A61530889A883107E57BF143E2E911655788170E5BE0BF6441E4B39D11D00ADD6BCC6422699EF5875066571F2431DCB27263 EF0F6EB81054AAEC74D286428E681F6A497FE925CE17B209C16A9FBB13B416A67F1402674F90E17ADFD527EEA08C3E99F96ED120530C9F442D4F724FFBB2908A4145BB1C176B0C3914ECC4 084A4A681C557239E59F36520E5A2E9E88E2E5D459F701A655072DF5E7738F90151B96E2457FC11B205255A6EECD9988D61AFC76EF2856B069BE8F0DD92 ---- Files - GMER 1.0.15 ---- File C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.002 (size mismatch) 868352/851968 bytes ---- EOF - GMER 1.0.15 ---- hab nochmal nachgeschaut. aber recovery cd nicht dabei gewesen. gruß derd |
|
01.11.2009, 16:16
| #8 | |
| | G-data 18 viren in quarantäne Hallo Zitat:
EDIT: Aktuell scheinen mir die Einträge bei GMER gewollt. MFG
__________________ Kein Support per PN - Bitte im Forum posten. Wenn du das Forum unterstützen möchtest Genitiv ins Wasser, weil es dativ ist http://www.vivaconagua.org/ |
|
01.11.2009, 16:27
| #9 |
| | G-data 18 viren in quarantäne hört sich ja mal ganz gut an mit dem Gmer. das hat mein g-data upgrade auf version 2010 noch gefunden: Virenprüfung mit G Data AntiVirus Version 20.2.1.8 (23.10.2009) Virensignaturen vom 01.11.2009 Startzeit: 01.11.2009 03:12:03 Engine(s): Engine A (AVA 19.8542), Engine B (AVB 19.529) Heuristik: Ein Archive: Ein Systembereiche: Ein RootKits prüfen: Ein Prüfung der Systembereiche... Prüfung auf RootKits... Prüfung aller lokalen Festplatten... Objekt: rnsetup0.exe Pfad: C:\Users\titten\AppData\Local\Temp Status: Virus gefunden Virus: Trojan.Generic.IS.563108 (Engine A) Objekt: Keygen.exe In Archiv: C:\Users\titten\Documents\Downloads\Adobe Photoshop CS4 Extended v.11 - [Retail]\Adobe Photoshop CS4 Extended v.11 - [Retail].7z Status: Virus gefunden Virus: Win32:Malware-gen (Engine B) Objekt: Adobe Photoshop CS4 Extended v.11 - [Retail].7z Pfad: C:\Users\titten\Documents\Downloads\Adobe Photoshop CS4 Extended v.11 - [Retail] Status: Virus gefunden Virus: Win32:Malware-gen (Engine B) Analyse vollständig durchgeführt: 01.11.2009 07:03:45 241697 Dateien überprüft 2 infizierte Dateien gefunden 0 verdächtige Dateien gefunden dann erstmal vielen dank für die hilfe. und illegale downloads gibts erstmal nicht mehr. |
|
| Themen zu G-data 18 viren in quarantäne |
| adobe, antivirus, bho, computer, defender, firefox, g data, g-data, google, hijack, hijackthis, internet, internet explorer, logfile, magix, mozilla, mp3, object, plug-in, programdata, proxy, rundll, safer networking, security, server, software, system, tuneup.defrag, tuprogst.exe, viren, vista, windows, windows internet, windows internet explorer |
Linear-Darstellung
