| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Wie kann ich diese Viren entfernen?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
31.10.2009, 18:19
| #16 |
| /// Selecta Jahrusso   |  Wie kann ich diese Viren entfernen? schritt 1 Zweiter Lauf mit Gmer
schritt 2 Scan mit SystemLook Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. Download Mirror #1 - Download Mirror #2
Poste bitte beide Logfiles
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
31.10.2009, 18:47
| #17 |
 | Wie kann ich diese Viren entfernen? GMER:
__________________Code:
ATTFilter GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-10-31 18:40:22
Windows 5.1.2600 Service Pack 3
Running: b56nr1n9.exe; Driver: C:\DOKUME~1\Marion\LOKALE~1\Temp\kwtyipow.sys
---- Modules - GMER 1.0.15 ----
Module viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) F7B22000-F7B24000 (8192 bytes)
Module videX32.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) F78AE000-F78B6000 (32768 bytes)
Module xfilt.sys (ATA/ATAPI devices hot-plug monitor/VIA Technologies,Inc) F78B6000-F78BE000 (32768 bytes)
Module \SystemRoot\system32\DRIVERS\vtmini.sys (VIA/S3G Miniport Driver/Copyright (C) VIA/S3 Graphics Co, Ltd.) F72D1000-F7312000 (266240 bytes)
Module \SystemRoot\system32\DRIVERS\EMS7SK.sys (ENE PCI Memory Stick Card Reader Driver/ENE Technology Inc.) F76FE000-F770E000 (65536 bytes)
Module \SystemRoot\system32\DRIVERS\ESD7SK.sys (ENE PCI Secure Digital / MMC Card Reader Driver/ENE Technology Inc.) F770E000-F7718000 (40960 bytes)
Module \SystemRoot\system32\drivers\vinyl97.sys (Vinyl AC'97 Codec Combo WDM Driver/VIA Technologies, Inc.) F7230000-F7262000 (204800 bytes)
Module \SystemRoot\system32\DRIVERS\smserial.sys (Motorola SM56 Modem WDM Driver/Motorola Inc.) F7121000-F720C000 (962560 bytes)
Module \SystemRoot\system32\DRIVERS\fetnd5bv.sys (NDIS 5.0 miniport driver/VIA Technologies, Inc. ) F776E000-F7779000 (45056 bytes)
Module \SystemRoot\system32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) F793E000-F7943000 (20480 bytes)
Module \??\C:\WINDOWS\system32\Drivers\uzi3ndu1.sys F780E000-F7818000 (40960 bytes)
Module \SystemRoot\system32\DRIVERS\RTL8187.sys (Realtek RTL8187 NDIS Driver/Realtek Semiconductor Corporation ) F5FA6000-F5FD3000 (184320 bytes)
Module \SystemRoot\System32\Drivers\aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) F782E000-F7838000 (40960 bytes)
Module \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) F5DC4000-F5DE7000 (143360 bytes)
Module \SystemRoot\System32\Drivers\Aavmker4.SYS (avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP/ALWIL Software) F7996000-F799C000 (24576 bytes)
Module \SystemRoot\System32\vtdisp.dll (VIA/S3G Graphics Driver/VIA/S3 Graphics Co, Ltd.) BF012000-BF36D000 (3518464 bytes)
Module \SystemRoot\System32\Drivers\aswFsBlk.SYS (avast! File System Access Blocking Driver/ALWIL Software) F6FE3000-F6FE6000 (12288 bytes)
Module \SystemRoot\System32\Drivers\aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) F15E5000-F15FC000 (94208 bytes)
Module \SystemRoot\System32\Drivers\aswRdr.SYS (avast! TDI RDR Driver/ALWIL Software) F78FE000-F7903000 (20480 bytes)
Module \??\C:\DOKUME~1\Marion\LOKALE~1\Temp\kwtyipow.sys (GMER) F0A4E000-F0A64000 (90112 bytes)
---- Processes - GMER 1.0.15 ----
Process C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) 192
Library C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) 0x00400000
Process C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe (avast! Antivirus/ALWIL Software) 804
Library C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe (avast! Antivirus/ALWIL Software) 0x00400000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswUtil.dll (avast! Utility library/ALWIL Software) 0x64780000
Library C:\PROGRA~1\ALWILS~1\Avast5\ashBase.dll (Basic Functionality Module/ALWIL Software) 0x64500000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswEngLdr.dll (Antivirus engine loader/ALWIL Software) 0x64BC0000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswCmnOS.dll (Antivirus HW dependent library/ALWIL Software) 0x64C00000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswCmnIS.dll (Antivirus independent functions/ALWIL Software) 0x64C40000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswCmnBS.dll (Common functions/ALWIL Software) 0x64C80000
Library C:\PROGRA~1\ALWILS~1\Avast5\ashTask.dll (Task Handling Module/ALWIL Software) 0x64800000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswLog.dll (avast! Log library/ALWIL Software) 0x64700000
Library C:\PROGRA~1\ALWILS~1\Avast5\SQLite.dll (avast! SQLite library/ALWIL Software) 0x64840000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswProperty.dll (avast! Property Storage library/ALWIL Software) 0x64740000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswAux.dll (avast! Auxiliary Library/ALWIL Software) 0x64580000
Library C:\Programme\Alwil Software\Avast5\1031\Base.dll (avast! German Basic Module/ALWIL Software) 0x66080000
Library C:\WINDOWS\system32\usp10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x75790000
Library C:\PROGRA~1\ALWILS~1\Avast5\aswData.dll (avast! UI Layer library/ALWIL Software) 0x64680000
Library C:\PROGRA~1\ALWILS~1\Avast5\ashTaskEx.dll (avast! TaskEx library/ALWIL Software) 0x647C0000
Library C:\PROGRA~1\ALWILS~1\Avast5\Aavm4h.dll (avast! Asynchronous Virus Monitor (AAVM)/ALWIL Software) 0x65000000
Library C:\PROGRA~1\ALWILS~1\Avast5\AavmRpch.dll (avast! AAVM Remote Procedure Call Library/ALWIL Software) 0x65400000
Library C:\PROGRA~1\ALWILS~1\Avast5\1031\UILangRes.dll (UILangRes/ALWIL Software) 0x660C0000
Library C:\PROGRA~1\ALWILS~1\Avast5\CommonRes.dll (Common UI resources/ALWIL Software) 0x66100000
Process C:\WINDOWS\Explorer.EXE (Windows Explorer/Microsoft Corporation) 1596
Library C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroDigitalExt.dll (Nero Digital Shell Extension/Nero AG) 0x10000000
Library C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll (PDF Shell Extension/Adobe Systems, Inc.) 0x02790000
Library C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU 0x02800000
Library C:\Programme\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes' Anti-Malware/Malwarebytes Corporation) 0x028A0000
Library C:\Programme\Alwil Software\Avast5\ashShell.dll (avast! Shell Extension/ALWIL Software) 0x64E40000
Process C:\Programme\Alwil Software\Avast5\AvastSvc.exe (avast! Service/ALWIL Software) 1728
Library C:\Programme\Alwil Software\Avast5\AvastSvc.exe (avast! Service/ALWIL Software) 0x00400000
Library C:\Programme\Alwil Software\Avast5\aswCmnBS.dll (Common functions/ALWIL Software) 0x64C80000
Library C:\Programme\Alwil Software\Avast5\aswCmnOS.dll (Antivirus HW dependent library/ALWIL Software) 0x64C00000
Library C:\Programme\Alwil Software\Avast5\aswCmnIS.dll (Antivirus independent functions/ALWIL Software) 0x64C40000
Library C:\Programme\Alwil Software\Avast5\ashServ.dll (avast! antivirus service/ALWIL Software) 0x65080000
Library C:\Programme\Alwil Software\Avast5\aswAux.dll (avast! Auxiliary Library/ALWIL Software) 0x64580000
Library C:\Programme\Alwil Software\Avast5\aswEngLdr.dll (Antivirus engine loader/ALWIL Software) 0x64BC0000
Library C:\Programme\Alwil Software\Avast5\ashBase.dll (Basic Functionality Module/ALWIL Software) 0x64500000
Library C:\Programme\Alwil Software\Avast5\ashTask.dll (Task Handling Module/ALWIL Software) 0x64800000
Library C:\Programme\Alwil Software\Avast5\aswLog.dll (avast! Log library/ALWIL Software) 0x64700000
Library C:\Programme\Alwil Software\Avast5\SQLite.dll (avast! SQLite library/ALWIL Software) 0x64840000
Library C:\Programme\Alwil Software\Avast5\aswProperty.dll (avast! Property Storage library/ALWIL Software) 0x64740000
Library C:\Programme\Alwil Software\Avast5\ashTaskEx.dll (avast! TaskEx library/ALWIL Software) 0x647C0000
Library C:\Programme\Alwil Software\Avast5\Aavm4h.dll (avast! Asynchronous Virus Monitor (AAVM)/ALWIL Software) 0x65000000
Library C:\Programme\Alwil Software\Avast5\AavmRpch.dll (avast! AAVM Remote Procedure Call Library/ALWIL Software) 0x65400000
Library C:\Programme\Alwil Software\Avast5\aswIdle.dll (avast! Idle Hook Library/ALWIL Software) 0x64A00000
Library C:\Programme\Alwil Software\Avast5\1031\Base.dll (avast! German Basic Module/ALWIL Software) 0x66080000
Library C:\Programme\Alwil Software\Avast5\defs\09103000\aswEngin.dll (High level antivirus engine/ALWIL Software) 0x64240000
Library C:\Programme\Alwil Software\Avast5\defs\09103000\aswCmnOS.dll (Antivirus HW dependent library/ALWIL Software) 0x64000000
Library C:\Programme\Alwil Software\Avast5\defs\09103000\aswCmnIS.dll (Antivirus independent functions/ALWIL Software) 0x64100000
Library C:\Programme\Alwil Software\Avast5\defs\09103000\aswCmnBS.dll (Common functions/ALWIL Software) 0x64080000
Library C:\Programme\Alwil Software\Avast5\defs\09103000\aswScan.dll (Low level antivirus engine/ALWIL Software) 0x64200000
Library C:\Programme\Alwil Software\Avast5\defs\09103000\algo.dll 0x63400000
Library C:\Programme\Alwil Software\Avast5\AhResBhv.dll (avast! Behavior Shield AAVM Provider Library/ALWIL Software) 0x65920000
Library C:\Programme\Alwil Software\Avast5\AhResMai.dll (avast! e-Mail Scanner AAVM Provider Library/ALWIL Software) 0x65840000
Library C:\Programme\Alwil Software\Avast5\ahResMes.dll (avast! Messenger scanner AAVM Provider Library/ALWIL Software) 0x65880000
Library C:\Programme\Alwil Software\Avast5\AhResNS.dll (avast! Network Shield AAVM Provider Library/ALWIL Software) 0x658C0000
Library C:\Programme\Alwil Software\Avast5\ahResP2P.dll (avast! P2P Shield AAVM Provider Library/ALWIL Software) 0x658A0000
Library C:\Programme\Alwil Software\Avast5\AhResStd.dll (avast! Standard Shield AAVM Provider Library/ALWIL Software) 0x65800000
Library C:\Programme\Alwil Software\Avast5\AhResWS.dll (avast! HTTP Scanner AAVM Provider Library/ALWIL Software) 0x658E0000
Library C:\Programme\Alwil Software\Avast5\ashMaiSv.dll (avast! e-Mail Scanner Service/ALWIL Software) 0x65200000
Library C:\Programme\Alwil Software\Avast5\ashWebSv.dll (avast! Web Scanner/ALWIL Software) 0x65100000
Library C:\Programme\Alwil Software\Avast5\ashWsFtr.dll (avast! Web Shield Filter Module/ALWIL Software) 0x68300000
Process C:\WINDOWS\system32\spoolsv.exe (Spooler SubSystem App/Microsoft Corporation) 1932
Library C:\WINDOWS\system32\HpTcpMon.dll (Standard TCP/IP Port Monitor DLL/Hewlett Packard) 0x10000000
Library C:\WINDOWS\system32\hpzjrd01.dll (HP Rediscovery Library/Hewlett Packard) 0x00980000
Library C:\WINDOWS\system32\HPTcpMUI.dll (Standard TCP/IP Port Monitor UI DLL/Microsoft Corporation) 0x00D00000
Library C:\WINDOWS\system32\hptcpmib.dll (Standard TCP/IP Port Monitor DLL/Hewlett Packard) 0x00D60000
Library C:\WINDOWS\system32\hpzll054.dll (LanguageMonitor/Hewlett-Packard Company) 0x00DA0000
Library C:\WINDOWS\system32\mdimon.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x00DB0000
Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp054.dll (Hewlett-Packard Corporation) 0x00E20000
Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x00E40000
Process C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Downloads\Antiviren\b56nr1n9.exe 3880
Library C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Downloads\Antiviren\b56nr1n9.exe 0x00400000
---- Services - GMER 1.0.15 ----
Service (avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP/ALWIL Software) [SYSTEM] Aavmker4
Service (avast! File System Access Blocking Driver/ALWIL Software) [AUTO] aswFsBlk
Service (avast! File System Filter Driver for Windows XP/ALWIL Software) [AUTO] aswMon2
Service (avast! TDI RDR Driver/ALWIL Software) [MANUAL] aswRdr
Service (avast! self protection module/ALWIL Software) [SYSTEM] aswSP
Service (avast! TDI Filter Driver/ALWIL Software) [SYSTEM] aswTdi
Service C:\Programme\Alwil Software\Avast5\AvastSvc.exe (avast! Service/ALWIL Software) [AUTO] avast! Antivirus
Service C:\Programme\Alwil Software\Avast5\AvastSvc.exe (avast! Service/ALWIL Software) [MANUAL] avast! Mail Scanner
Service C:\Programme\Alwil Software\Avast5\AvastSvc.exe (avast! Service/ALWIL Software) [MANUAL] avast! Web Scanner
Service C:\WINDOWS\system32\DRIVERS\EMS7SK.sys (ENE PCI Memory Stick Card Reader Driver/ENE Technology Inc.) [MANUAL] EMSCR
Service C:\WINDOWS\system32\DRIVERS\ESD7SK.sys (ENE PCI Secure Digital / MMC Card Reader Driver/ENE Technology Inc.) [MANUAL] ESDCR
Service C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys (NDIS 5.0 miniport driver/VIA Technologies, Inc. ) [MANUAL] FETND5BV
Service C:\WINDOWS\system32\DRIVERS\fetnd5.sys (NDIS 5.0 miniport driver/VIA Technologies, Inc. ) [MANUAL] FETNDIS
Service C:\Programme\Google\Update\GoogleUpdate.exe [AUTO] gupdate1c9b2e728892258
Service C:\WINDOWS\system32\DRIVERS\HPZid412.sys (IEEE-1284.4-1999 Driver (Windows 2000)/HP) [MANUAL] HPZid412
Service C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (IEEE-1284.4-1999 Print Class Driver/HP) [MANUAL] HPZipr12
Service C:\WINDOWS\system32\DRIVERS\HPZius12.sys (1284.4<->Usb Datalink Driver (Windows 2000)/HP) [MANUAL] HPZius12
Service Outlook
Service C:\WINDOWS\system32\HPZipm12.exe (PML Driver/HP) [AUTO] Pml Driver HPZ12
Service C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) [MANUAL] Ptilink
Service C:\WINDOWS\system32\DRIVERS\RTL8187.sys (Realtek RTL8187 NDIS Driver/Realtek Semiconductor Corporation ) [MANUAL] RTLWUSB
Service C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [MANUAL] Secdrv
Service C:\WINDOWS\system32\DRIVERS\smserial.sys (Motorola SM56 Modem WDM Driver/Motorola Inc.) [MANUAL] smserial
Service C:\WINDOWS\system32\Drivers\uzi3ndu1.sys [SYSTEM] uzi3ndu1
Service vdi3ndu1
Service VIA Codec Default
Service C:\WINDOWS\system32\DRIVERS\vtmini.sys (VIA/S3G Miniport Driver/Copyright (C) VIA/S3 Graphics Co, Ltd.) [MANUAL] viagfx
Service C:\WINDOWS\system32\DRIVERS\viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) [BOOT] ViaIde
Service C:\WINDOWS\system32\drivers\vinyl97.sys (Vinyl AC'97 Codec Combo WDM Driver/VIA Technologies, Inc.) [MANUAL] VIAudio
Service C:\WINDOWS\system32\DRIVERS\videX32.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) [BOOT] videX32
Service C:\WINDOWS\system32\DRIVERS\WinDSL.sys (WinDSL-Protokoll Treiber/Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) [MANUAL] WinDSLa
Service Wmi
Service C:\WINDOWS\system32\DRIVERS\xfilt.sys (ATA/ATAPI devices hot-plug monitor/VIA Technologies,Inc) [BOOT] xfilt
---- EOF - GMER 1.0.15 ----
Code:
ATTFilter SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 18:45 on 31/10/2009 by Marion (Administrator - Elevation successful)
========== reg ==========
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs]
(Unable to open key - key not found)
-=End Of File=-
|
|
31.10.2009, 18:50
| #18 |
| /// Selecta Jahrusso | Wie kann ich diese Viren entfernen? schritt 1
__________________Wende bitte Malwarebytes nach Anleitung an. (Quickscan reicht) schritt 2 Schliesse bitte alle laufenden Programme inkl Browser. Lösche bitte die Extra.txt von Deinem Desktop. Doppelklick auf die OTL.exe und poste beide Logfiles.
__________________ |
|
31.10.2009, 20:16
| #19 |
| | Wie kann ich diese Viren entfernen? Malwarebytes: Code:
ATTFilter Malwarebytes' Anti-Malware 1.41
Datenbank Version: 3070
Windows 5.1.2600 Service Pack 3
31.10.2009 20:08:38
mbam-log-2009-10-31 (20-08-38).txt
Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 112857
Laufzeit: 22 minute(s), 29 second(s)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
OTL Teil1: Code:
ATTFilter OTL logfile created on: 31.10.2009 20:12:13 - Run 4 OTL by OldTimer - Version 3.1.1.6 Folder = C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Downloads\Antiviren Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 446,11 Mb Total Physical Memory | 169,28 Mb Available Physical Memory | 37,95% Memory free 1,03 Gb Paging File | 0,89 Gb Available in Paging File | 86,25% Paging File free Paging file location(s): C:\pagefile.sys 674 674 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 74,52 Gb Total Space | 64,71 Gb Free Space | 86,84% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: TEST-112 Current User Name: Marion Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Downloads\Antiviren\OTL.exe (OldTimer Tools) PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (ALWIL Software) PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\HPZipm12.exe (HP) ========== Win32 Services (SafeList) ========== SRV - File not found SRV - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) SRV - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) SRV - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) SRV - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation) SRV - C:\Programme\Windows Media Player\WMPNetwk.exe (Microsoft Corporation) SRV - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe (Microsoft Corporation) SRV - C:\WINDOWS\system32\HPZipm12.exe (HP) ========== Driver Services (SafeList) ========== DRV - C:\WINDOWS\system32\drivers\uzi3ndu1.sys () DRV - C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software) DRV - C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software) DRV - C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software) DRV - C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software) DRV - C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software) DRV - C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software) DRV - C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - C:\WINDOWS\system32\drivers\vtmini.sys (Copyright (C) VIA/S3 Graphics Co, Ltd.) DRV - C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.) DRV - C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.) DRV - C:\WINDOWS\system32\drivers\RTL8187.sys (Realtek Semiconductor Corporation ) DRV - C:\WINDOWS\system32\drivers\vinyl97.sys (VIA Technologies, Inc.) DRV - C:\WINDOWS\system32\drivers\HPZid412.sys (HP) DRV - C:\WINDOWS\system32\drivers\HPZius12.sys (HP) DRV - C:\WINDOWS\system32\drivers\HPZipr12.sys (HP) DRV - C:\WINDOWS\system32\drivers\smserial.sys (Motorola Inc.) DRV - C:\WINDOWS\system32\drivers\fetnd5bv.sys (VIA Technologies, Inc. ) DRV - C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.) DRV - C:\WINDOWS\system32\DRIVERS\xfilt.sys (VIA Technologies,Inc) DRV - C:\WINDOWS\system32\DRIVERS\videX32.sys (VIA Technologies, Inc.) DRV - C:\WINDOWS\system32\drivers\windsl.sys (Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) DRV - C:\WINDOWS\system32\drivers\fetnd5.sys (VIA Technologies, Inc. ) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Downloads\Antiviren\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\srclient.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\wbem\framedyn.dll (Microsoft Corporation) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.google.de/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.4 FF - HKLM\software\mozilla\Mozilla Firefox 3.5.4\extensions\\Components: C:\Programme\Mozilla Firefox\components [2009.10.29 20:43:51 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.4\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2009.10.29 20:43:51 | 00,000,000 | ---D | M] C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\Mozilla\Extensions -> [2009.10.29 19:46:58 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} -> [2009.10.29 19:46:58 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\Mozilla\Firefox\Profiles\h7qk623b.default\extensions -> [2009.10.30 15:31:56 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\Mozilla\Firefox\Profiles\h7qk623b.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} -> [2009.10.29 20:44:51 | 00,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions -> [2009.10.29 19:46:43 | 00,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} -> [2009.10.29 20:43:51 | 00,000,000 | ---D | M] -- [2009.10.29 20:43:42 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browserdirprovider.dll [2009.10.29 20:43:42 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\brwsrcmp.dll [2009.02.24 20:34:32 | 01,044,480 | ---- | M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Programme\Mozilla Firefox\plugins\libdivx.dll [2009.02.24 20:34:14 | 01,337,648 | ---- | M] (DivX,Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdivx32.dll [2009.10.29 20:43:44 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Programme\Mozilla Firefox\plugins\npnul32.dll [2006.10.26 19:12:16 | 00,016,192 | ---- | M] (Microsoft Corporation) -- C:\Programme\Mozilla Firefox\plugins\NPOFF12.DLL [2009.02.27 11:13:42 | 00,103,792 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Mozilla Firefox\plugins\nppdf32.dll [2009.02.24 20:34:32 | 00,200,704 | ---- | M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Programme\Mozilla Firefox\plugins\ssldivx.dll [2009.08.24 20:25:19 | 00,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2009.08.24 20:25:19 | 00,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2009.08.24 20:25:19 | 00,002,371 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\google.xml [2009.08.24 20:25:19 | 00,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2009.08.24 20:25:19 | 00,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2009.08.24 20:25:19 | 00,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: (820 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\AvastUI.exe (ALWIL Software) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1256911654937 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1256911647296 (MUWebControl Class) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.04.01 16:54:32 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found |
|
31.10.2009, 20:17
| #20 |
| | Wie kann ich diese Viren entfernen? OTL Teil2: Code:
ATTFilter ========== Files/Folders - Created Within 30 Days ==========
[2009.10.31 18:26:44 | 00,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Marion\Recent
[2009.10.31 18:24:30 | 00,268,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2009.10.31 18:24:30 | 00,027,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2009.10.31 18:24:29 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2009.10.31 18:24:04 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Desktop\Reinigung
[2009.10.31 18:14:11 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\vlc
[2009.10.31 18:12:17 | 00,000,000 | ---D | C] -- C:\Programme\VideoLAN
[2009.10.31 16:30:22 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Desktop\avz4
[2009.10.31 12:52:21 | 00,149,328 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009.10.31 12:52:21 | 00,019,024 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009.10.31 12:52:19 | 00,023,248 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009.10.31 12:52:18 | 00,046,544 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009.10.31 12:52:16 | 00,100,176 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009.10.31 12:52:16 | 00,094,544 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009.10.31 12:52:15 | 00,027,728 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009.10.31 12:51:59 | 00,149,600 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009.10.31 04:24:08 | 00,000,000 | ---D | C] -- C:\Programme\Defraggler
[2009.10.30 21:13:16 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\Malwarebytes
[2009.10.30 21:09:59 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009.10.30 21:09:58 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009.10.30 21:09:58 | 00,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2009.10.30 21:09:58 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2009.10.30 17:23:23 | 00,000,000 | ---D | C] -- C:\Programme\Alwil Software
[2009.10.30 16:45:41 | 00,000,000 | ---D | C] -- C:\Programme\CCleaner
[2009.10.30 15:47:24 | 25,198,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009.10.30 15:21:20 | 00,331,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadce.dll
[2009.10.30 15:19:23 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall
[2009.10.30 15:07:54 | 00,043,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wups2.dll
[2009.10.30 15:07:54 | 00,031,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll.mui
[2009.10.30 15:07:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2009.10.30 15:07:53 | 00,027,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaucpl.cpl.mui
[2009.10.30 15:07:53 | 00,027,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui
[2009.10.30 15:07:53 | 00,018,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng.dll.mui
[2009.10.30 01:41:15 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2009.10.30 01:12:22 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Lokale Einstellungen\Anwendungsdaten\PCHealth
[2009.10.30 01:03:59 | 00,136,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msv1_0.dll
[2009.10.30 01:03:39 | 01,441,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\query.dll
[2009.10.30 01:03:34 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msasn1.dll
[2009.10.30 01:02:03 | 00,153,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\triedit.dll
[2009.10.30 01:01:35 | 00,078,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\telnet.exe
[2009.10.30 01:01:30 | 00,132,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wkssvc.dll
[2009.10.30 01:01:26 | 00,085,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avifil32.dll
[2009.10.30 01:01:19 | 00,206,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009.10.30 01:01:13 | 00,128,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009.10.30 01:01:08 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atl.dll
[2009.10.30 01:00:49 | 01,315,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoe.dll
[2009.10.30 01:00:31 | 00,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2009.10.30 01:00:19 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpshims.dll
[2009.10.30 01:00:18 | 11,069,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
[2009.10.30 01:00:18 | 01,985,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
[2009.10.30 01:00:18 | 00,594,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
[2009.10.30 01:00:18 | 00,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieproxy.dll
[2009.10.30 01:00:18 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2009.10.30 00:59:54 | 00,119,808 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\t2embed.dll
[2009.10.30 00:59:54 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fontsub.dll
[2009.10.30 00:59:48 | 01,296,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\quartz.dll
[2009.10.30 00:59:42 | 00,585,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcrt4.dll
[2009.10.30 00:59:34 | 01,847,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\win32k.sys
[2009.10.30 00:59:25 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\localspl.dll
[2009.10.30 00:59:11 | 01,063,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kernel32.dll
[2009.10.30 00:59:11 | 00,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\secur32.dll
[2009.10.30 00:59:05 | 00,354,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\winhttp.dll
[2009.10.30 00:58:41 | 02,191,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2009.10.30 00:58:41 | 00,453,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2009.10.30 00:58:41 | 00,401,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcss.dll
[2009.10.30 00:58:41 | 00,286,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pdh.dll
[2009.10.30 00:58:41 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009.10.30 00:58:41 | 00,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\services.exe
[2009.10.30 00:58:40 | 02,147,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2009.10.30 00:58:40 | 02,068,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2009.10.30 00:58:40 | 02,026,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2009.10.30 00:58:40 | 00,740,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntdll.dll
[2009.10.30 00:58:40 | 00,737,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lsasrv.dll
[2009.10.30 00:58:40 | 00,678,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\advapi32.dll
[2009.10.30 00:58:40 | 00,473,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fastprox.dll
[2009.10.30 00:58:29 | 00,956,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtctm.dll
[2009.10.30 00:58:29 | 00,428,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtcprx.dll
[2009.10.30 00:58:29 | 00,161,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtcuiu.dll
[2009.10.30 00:58:29 | 00,091,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxoci.dll
[2009.10.30 00:58:29 | 00,066,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mtxclu.dll
[2009.10.30 00:58:29 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdtclog.dll
[2009.10.30 00:58:21 | 00,217,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wordpad.exe
[2009.10.30 00:58:20 | 00,003,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp4res.dll
[2009.10.30 00:58:15 | 00,147,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\schannel.dll
[2009.10.30 00:58:10 | 00,333,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys
[2009.10.30 00:57:57 | 00,286,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\gdi32.dll
[2009.10.30 00:57:50 | 00,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2009.10.30 00:57:39 | 01,106,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml3.dll
[2009.10.30 00:57:33 | 00,455,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2009.10.30 00:57:27 | 00,337,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll
[2009.10.30 00:57:22 | 00,273,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys
[2009.10.30 00:57:12 | 00,104,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\win32spl.dll
[2009.10.30 00:57:12 | 00,074,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msw3prt.dll
[2009.10.30 00:56:46 | 00,253,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\es.dll
[2009.10.30 00:56:41 | 00,691,712 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcomm.dll
[2009.10.30 00:56:35 | 00,074,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mscms.dll
[2009.10.30 00:56:23 | 00,361,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tcpip.sys
[2009.10.30 00:56:23 | 00,247,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mswsock.dll
[2009.10.30 00:56:23 | 00,225,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\tcpip6.sys
[2009.10.30 00:56:23 | 00,147,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dnsapi.dll
[2009.10.30 00:56:23 | 00,138,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\afd.sys
[2009.10.30 00:56:17 | 00,203,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rmcast.sys
[2009.10.29 21:58:01 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\avg9
[2009.10.29 21:57:47 | 00,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2009.10.29 20:56:29 | 00,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2009.10.29 20:54:44 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Downloads
[2009.10.29 20:33:55 | 00,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2009.10.29 20:33:55 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2009.10.29 20:32:59 | 00,000,000 | ---D | C] -- C:\Programme\Wise Registry Cleaner 4 Free
[2009.10.29 19:49:30 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ctfmon.exe.backup
[2009.10.29 19:48:16 | 00,000,000 | ---D | C] -- C:\Programme\xp-AntiSpy
[2009.10.29 19:46:51 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\Mozilla
[2009.10.29 19:46:13 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\MSNInstaller
[2009.10.29 19:27:47 | 00,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2009.10.29 19:17:08 | 01,307,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msxml6.dll
[2009.10.29 19:17:08 | 01,307,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml6.dll
[2009.10.29 19:17:08 | 00,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msxml6r.dll
[2009.10.29 19:17:08 | 00,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml6r.dll
[2009.10.29 19:17:05 | 00,377,984 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvaa.dll
[2009.10.29 19:17:05 | 00,229,376 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2cqag.dll
[2009.10.29 19:17:05 | 00,201,728 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvag.dll
[2009.10.29 19:17:05 | 00,136,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\aaclient.dll
[2009.10.29 19:17:04 | 01,888,992 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ati3duag.dll
[2009.10.29 19:17:04 | 00,870,784 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ati3d1ag.dll
[2009.10.29 19:17:04 | 00,516,768 | ---- | C] (ATI Technologies Inc. ) -- C:\WINDOWS\System32\ativvaxx.dll
[2009.10.29 19:17:04 | 00,233,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\azroles.dll
[2009.10.29 19:17:04 | 00,032,768 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativtmxx.dll
[2009.10.29 19:17:04 | 00,023,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativmvxx.ax
[2009.10.29 19:17:04 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\credssp.dll
[2009.10.29 19:17:04 | 00,009,728 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativdaxx.ax
[2009.10.29 19:17:04 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bitsprx4.dll
[2009.10.29 19:17:03 | 00,651,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3ui.dll
[2009.10.29 19:17:03 | 00,184,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapp3hst.dll
[2009.10.29 19:17:03 | 00,182,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapphost.dll
[2009.10.29 19:17:03 | 00,133,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3svc.dll
[2009.10.29 19:17:03 | 00,126,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappcfg.dll
[2009.10.29 19:17:03 | 00,095,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappgnui.dll
[2009.10.29 19:17:03 | 00,062,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3cfg.dll
[2009.10.29 19:17:03 | 00,059,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapqec.dll
[2009.10.29 19:17:03 | 00,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3msm.dll
[2009.10.29 19:17:03 | 00,048,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dhcpqec.dll
[2009.10.29 19:17:03 | 00,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappprxy.dll
[2009.10.29 19:17:03 | 00,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3gpclnt.dll
[2009.10.29 19:17:03 | 00,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dimsroam.dll
[2009.10.29 19:17:03 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapsvc.dll
[2009.10.29 19:17:03 | 00,030,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapolqec.dll
[2009.10.29 19:17:03 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3api.dll
[2009.10.29 19:17:03 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dimsntfy.dll
[2009.10.29 19:17:03 | 00,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3dlg.dll
[2009.10.29 19:17:02 | 00,086,016 | ---- | C] (Conexant) -- C:\WINDOWS\System32\mdmxsdk.dll
[2009.10.29 19:17:02 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ieencode.dll
[2009.10.29 19:17:02 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kmsvc.dll
[2009.10.29 19:17:02 | 00,037,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\l2gpstore.dll
[2009.10.29 19:17:02 | 00,032,285 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\hsfcisp2.dll
[2009.10.29 19:17:02 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdpash.dll
[2009.10.29 19:17:02 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdnepr.dll
[2009.10.29 19:17:02 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdiultn.dll
[2009.10.29 19:17:02 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdbhc.dll
[2009.10.29 19:17:01 | 01,737,856 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\mtxparhd.dll
[2009.10.29 19:17:01 | 00,397,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmcex.dll
[2009.10.29 19:17:01 | 00,198,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napmontr.dll
[2009.10.29 19:17:01 | 00,184,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\microsoft.managementconsole.dll
[2009.10.29 19:17:01 | 00,177,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napstat.exe
[2009.10.29 19:17:01 | 00,155,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mssha.dll
[2009.10.29 19:17:01 | 00,106,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmcfxcommon.dll
[2009.10.29 19:17:01 | 00,081,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msshavmsg.dll
[2009.10.29 19:17:01 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmcperf.exe
[2009.10.29 19:17:01 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napipsec.dll
[2009.10.29 19:17:00 | 04,274,816 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nv4_disp.dll
[2009.10.29 19:17:00 | 00,412,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\photometadatahandler.dll
[2009.10.29 19:17:00 | 00,397,056 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\s3gnb.dll
[2009.10.29 19:17:00 | 00,294,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qagentrt.dll
[2009.10.29 19:17:00 | 00,290,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rhttpaa.dll
[2009.10.29 19:17:00 | 00,286,792 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slextspk.dll
[2009.10.29 19:17:00 | 00,188,508 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slgen.dll
[2009.10.29 19:17:00 | 00,151,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qagent.dll
[2009.10.29 19:17:00 | 00,145,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\onex.dll
[2009.10.29 19:17:00 | 00,076,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qutil.dll
[2009.10.29 19:17:00 | 00,073,832 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slcoinst.dll
[2009.10.29 19:17:00 | 00,073,796 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slserv.exe
[2009.10.29 19:17:00 | 00,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qcliprov.dll
[2009.10.29 19:17:00 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rasqec.dll
[2009.10.29 19:17:00 | 00,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slrundll.exe
[2009.10.29 19:17:00 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\setupn.exe
[2009.10.29 19:16:59 | 00,712,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\windowscodecs.dll
[2009.10.29 19:16:59 | 00,346,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\windowscodecsext.dll
[2009.10.29 19:16:59 | 00,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tsgqec.dll
[2009.10.29 19:16:59 | 00,050,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tspkg.dll
[2009.10.29 19:16:59 | 00,046,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tzchange.exe
[2009.10.29 19:16:59 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\vidcap.ax
[2009.10.29 19:16:59 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\verclsid.exe
[2009.10.29 19:16:58 | 00,276,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmphoto.dll
[2009.10.29 19:16:58 | 00,069,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wlanapi.dll
[2009.10.29 19:16:57 | 00,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\slrundll.exe
[2009.10.29 19:16:56 | 00,000,000 | ---D | C] -- C:\WINDOWS\l2schemas
[2009.10.29 19:16:56 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\de
[2009.10.29 19:16:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\bits
[2009.10.29 19:14:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
|
|
31.10.2009, 20:20
| #21 |
| | Wie kann ich diese Viren entfernen? OTL Teil3: Code:
ATTFilter [2009.10.29 19:12:31 | 00,044,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\agpcpq.sys
[2009.10.29 19:12:31 | 00,042,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\alim1541.sys
[2009.10.29 19:12:31 | 00,042,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\agp440.sys
[2009.10.29 19:12:31 | 00,004,255 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv01nt5.dll
[2009.10.29 19:12:31 | 00,003,967 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv02nt5.dll
[2009.10.29 19:12:31 | 00,003,775 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv11nt5.dll
[2009.10.29 19:12:31 | 00,003,711 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv09nt5.dll
[2009.10.29 19:12:31 | 00,003,647 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv07nt5.dll
[2009.10.29 19:12:31 | 00,003,615 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv05nt5.dll
[2009.10.29 19:12:31 | 00,003,135 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv08nt5.dll
[2009.10.29 19:12:31 | 00,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic
[2009.10.29 19:12:30 | 00,701,952 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtag.sys
[2009.10.29 19:12:30 | 00,327,168 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtaa.sys
[2009.10.29 19:12:30 | 00,104,960 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinrvxx.sys
[2009.10.29 19:12:30 | 00,073,216 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atintuxx.sys
[2009.10.29 19:12:30 | 00,063,663 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2009.10.29 19:12:30 | 00,057,856 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinbtxx.sys
[2009.10.29 19:12:30 | 00,056,623 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1btxx.sys
[2009.10.29 19:12:30 | 00,052,224 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinraxx.sys
[2009.10.29 19:12:30 | 00,043,008 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\drivers\amdagp.sys
[2009.10.29 19:12:30 | 00,036,463 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2009.10.29 19:12:30 | 00,034,735 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2009.10.29 19:12:30 | 00,031,744 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxbxx.sys
[2009.10.29 19:12:30 | 00,030,671 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1raxx.sys
[2009.10.29 19:12:30 | 00,029,455 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2009.10.29 19:12:30 | 00,028,672 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinsnxx.sys
[2009.10.29 19:12:30 | 00,026,367 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1snxx.sys
[2009.10.29 19:12:30 | 00,021,343 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2009.10.29 19:12:30 | 00,014,336 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinpdxx.sys
[2009.10.29 19:12:30 | 00,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinttxx.sys
[2009.10.29 19:12:30 | 00,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinmdxx.sys
[2009.10.29 19:12:30 | 00,012,047 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2009.10.29 19:12:30 | 00,011,615 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2009.10.29 19:12:29 | 00,063,488 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxsxx.sys
[2009.10.29 19:12:29 | 00,025,471 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv04nt5.dll
[2009.10.29 19:12:29 | 00,021,183 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv01nt5.dll
[2009.10.29 19:12:29 | 00,017,279 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv10nt5.dll
[2009.10.29 19:12:29 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthenum.sys
[2009.10.29 19:12:29 | 00,014,143 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv06nt5.dll
[2009.10.29 19:12:29 | 00,011,359 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv02nt5.dll
[2009.10.29 19:12:28 | 00,273,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthport.sys
[2009.10.29 19:12:28 | 00,101,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthpan.sys
[2009.10.29 19:12:28 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthmodem.sys
[2009.10.29 19:12:28 | 00,036,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthprint.sys
[2009.10.29 19:12:27 | 00,220,032 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\drivers\hsfbs2s2.sys
[2009.10.29 19:12:27 | 00,144,384 | ---- | C] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\drivers\hdaudbus.sys
[2009.10.29 19:12:27 | 00,046,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\gagp30kx.sys
[2009.10.29 19:12:27 | 00,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\hidbth.sys
[2009.10.29 19:12:27 | 00,019,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\hidir.sys
[2009.10.29 19:12:27 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthusb.sys
[2009.10.29 19:12:27 | 00,015,423 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\ch7xxnt5.dll
[2009.10.29 19:12:26 | 01,309,184 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlstrm.sys
[2009.10.29 19:12:26 | 01,041,536 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\drivers\hsfdpsp2.sys
[2009.10.29 19:12:26 | 00,685,056 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\drivers\hsfcxts2.sys
[2009.10.29 19:12:26 | 00,452,736 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\drivers\mtxparhm.sys
[2009.10.29 19:12:26 | 00,126,686 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys
[2009.10.29 19:12:26 | 00,012,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\mutohpen.sys
[2009.10.29 19:12:26 | 00,011,868 | ---- | C] (Conexant) -- C:\WINDOWS\System32\drivers\mdmxsdk.sys
[2009.10.29 19:12:25 | 01,897,408 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\drivers\nv4_mini.sys
[2009.10.29 19:12:25 | 00,404,990 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slntamr.sys
[2009.10.29 19:12:25 | 00,180,360 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys
[2009.10.29 19:12:25 | 00,166,912 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\drivers\s3gnbm.sys
[2009.10.29 19:12:25 | 00,129,535 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnt7554.sys
[2009.10.29 19:12:25 | 00,095,424 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnthal.sys
[2009.10.29 19:12:25 | 00,059,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rfcomm.sys
[2009.10.29 19:12:25 | 00,040,960 | ---- | C] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\System32\drivers\sisagp.sys
[2009.10.29 19:12:25 | 00,030,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rndismpx.sys
[2009.10.29 19:12:25 | 00,013,776 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\recagent.sys
[2009.10.29 19:12:25 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\sffp_mmc.sys
[2009.10.29 19:12:25 | 00,003,901 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\siint5.dll
[2009.10.29 19:12:24 | 00,121,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbvideo.sys
[2009.10.29 19:12:24 | 00,042,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\viaagp.sys
[2009.10.29 19:12:24 | 00,025,471 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\watv10nt.sys
[2009.10.29 19:12:24 | 00,022,271 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\watv06nt.sys
[2009.10.29 19:12:24 | 00,014,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\wacompen.sys
[2009.10.29 19:12:24 | 00,013,240 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slwdmsup.sys
[2009.10.29 19:12:24 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usb8023x.sys
[2009.10.29 19:12:24 | 00,011,935 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv11nt.sys
[2009.10.29 19:12:24 | 00,011,871 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv09nt.sys
[2009.10.29 19:12:24 | 00,011,807 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv07nt.sys
[2009.10.29 19:12:24 | 00,011,325 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\vchnt5.dll
[2009.10.29 19:12:24 | 00,011,295 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv08nt.sys
[2009.10.29 19:12:24 | 00,005,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\smbali.sys
[2009.10.29 19:07:41 | 00,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
[2009.10.29 19:07:37 | 00,000,000 | ---D | C] -- C:\WINDOWS\EHome
[2009.10.29 18:38:31 | 00,180,608 | R--- | C] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\System32\drivers\RTL8187.sys
[2009.10.29 18:31:18 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\hidserv.dll
[2009.10.29 18:02:41 | 00,055,656 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2009.10.29 18:01:50 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\DivX
[2009.10.29 18:00:52 | 00,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Marion\IECompatCache
[2009.10.27 18:51:39 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\TeamViewer
[2009.10.27 18:51:24 | 00,000,000 | ---D | C] -- C:\Programme\TeamViewer
[2009.10.27 18:50:36 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Marion\temp
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2009.10.31 19:20:00 | 00,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2009.10.31 18:26:48 | 00,002,503 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\Desktop\Office Word 2007.lnk
[2009.10.31 18:24:47 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009.10.31 18:12:50 | 00,000,691 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
[2009.10.31 17:48:50 | 00,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009.10.31 17:48:47 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009.10.31 17:48:43 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009.10.31 17:47:55 | 02,359,296 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\NTUSER.DAT
[2009.10.31 17:47:55 | 00,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Marion\ntuser.ini
[2009.10.31 16:31:42 | 00,011,264 | ---- | M] () -- C:\WINDOWS\System32\drivers\uzi3ndu1.sys
[2009.10.31 16:29:32 | 05,125,238 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\Desktop\avz4.zip
[2009.10.31 12:52:17 | 00,003,002 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009.10.31 01:42:13 | 01,646,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\NTUSER.rhk
[2009.10.30 16:06:50 | 00,036,296 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2009.10.30 16:00:09 | 01,835,008 | -H-- | M] () -- C:\Dokumente und Einstellungen\Marion\NTUSER.bak
[2009.10.30 15:51:08 | 00,161,936 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.10.30 15:41:32 | 00,000,582 | ---- | M] () -- C:\WINDOWS\win.ini
[2009.10.30 02:38:34 | 00,000,000 | -HS- | M] () -- C:\Dokumente und Einstellungen\Marion\ntuser.dll
[2009.10.30 00:59:51 | 00,732,344 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009.10.30 00:59:51 | 00,320,678 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2009.10.30 00:59:51 | 00,314,842 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009.10.30 00:59:51 | 00,049,562 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2009.10.30 00:59:51 | 00,041,170 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009.10.29 20:56:30 | 00,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\Desktop\HijackThis.lnk
[2009.10.29 20:33:26 | 00,000,478 | ---- | M] () -- C:\WINDOWS\tasks\Wise Registry Cleaner 4.job
[2009.10.29 20:30:23 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009.10.29 20:24:08 | 00,000,000 | -H-- | M] () -- C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Default.rdp
[2009.10.29 19:46:48 | 00,001,566 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2009.10.29 19:12:13 | 00,251,712 | RHS- | M] () -- C:\ntldr
[2009.10.29 19:01:28 | 00,003,584 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.29 18:05:48 | 00,002,607 | ---- | M] () -- C:\Dokumente und Einstellungen\Marion\Desktop\Office Outlook 2007.lnk
[2009.10.27 18:51:25 | 00,000,869 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 4.lnk
[2009.10.27 18:01:38 | 00,010,588 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\kofy.pif
[2009.10.25 16:10:08 | 00,019,173 | ---- | M] () -- C:\WINDOWS\System32\zohysom.lib
[2009.10.23 05:12:48 | 00,149,600 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009.10.23 04:22:07 | 00,046,544 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009.10.23 04:20:06 | 00,149,328 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009.10.23 04:09:46 | 00,023,248 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009.10.23 04:09:11 | 00,100,176 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009.10.23 04:09:07 | 00,094,544 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009.10.23 04:08:57 | 00,019,024 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009.10.23 04:08:36 | 00,027,728 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009.10.15 05:11:40 | 00,012,389 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kupyvuwotu.scr
[2009.10.12 05:03:22 | 00,010,946 | ---- | M] () -- C:\WINDOWS\puciz.com
[2009.10.08 05:02:48 | 00,016,671 | ---- | M] () -- C:\WINDOWS\bulumacebo.dat
[2009.10.06 05:47:31 | 00,018,509 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eraqoc._dl
[2009.10.06 05:47:31 | 00,018,378 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\qagos.com
[2009.10.06 05:47:31 | 00,016,925 | ---- | M] () -- C:\WINDOWS\opohyhi.com
[2009.10.06 05:47:31 | 00,016,908 | ---- | M] () -- C:\WINDOWS\xasygufap.exe
[2009.10.06 05:47:31 | 00,016,538 | ---- | M] () -- C:\WINDOWS\gerowetage.com
[2009.10.06 05:47:31 | 00,016,277 | ---- | M] () -- C:\WINDOWS\utosywer.inf
[2009.10.06 05:47:31 | 00,016,111 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\bytybofix.ban
[2009.10.06 05:47:31 | 00,015,357 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\edalyk.bin
[2009.10.06 05:47:31 | 00,014,840 | ---- | M] () -- C:\WINDOWS\okygan.db
[2009.10.06 05:47:31 | 00,014,749 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\ymecebep.bat
[2009.10.06 05:47:31 | 00,014,122 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\aqytepozin.inf
[2009.10.06 05:47:31 | 00,013,645 | ---- | M] () -- C:\WINDOWS\System32\ugusy.reg
[2009.10.06 05:47:31 | 00,013,439 | ---- | M] () -- C:\WINDOWS\itetinune.sys
[2009.10.06 05:47:31 | 00,012,533 | ---- | M] () -- C:\WINDOWS\junuqax.dat
[2009.10.06 05:47:31 | 00,012,306 | ---- | M] () -- C:\WINDOWS\System32\zawynykus.com
[2009.10.06 05:47:31 | 00,011,397 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\otetoli._sy
[2009.10.06 05:47:31 | 00,010,349 | ---- | M] () -- C:\WINDOWS\alidi.inf
[2009.10.06 05:47:31 | 00,010,083 | ---- | M] () -- C:\WINDOWS\atavu.dll
[2009.10.02 11:01:58 | 25,198,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2009.10.31 18:12:50 | 00,000,691 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk
[2009.10.31 16:31:42 | 00,011,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\uzi3ndu1.sys
[2009.10.31 16:29:20 | 05,125,238 | ---- | C] () -- C:\Dokumente und Einstellungen\Marion\Desktop\avz4.zip
[2009.10.30 16:52:36 | 01,646,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Marion\NTUSER.rhk
[2009.10.30 02:38:34 | 00,000,000 | -HS- | C] () -- C:\Dokumente und Einstellungen\Marion\ntuser.dll
[2009.10.30 00:58:20 | 01,203,922 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009.10.29 20:56:30 | 00,001,698 | ---- | C] () -- C:\Dokumente und Einstellungen\Marion\Desktop\HijackThis.lnk
[2009.10.29 20:33:26 | 00,000,478 | ---- | C] () -- C:\WINDOWS\tasks\Wise Registry Cleaner 4.job
[2009.10.29 20:24:08 | 00,000,000 | -H-- | C] () -- C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Default.rdp
[2009.10.29 19:46:48 | 00,001,566 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2009.10.29 19:12:29 | 00,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod
[2009.10.29 19:12:27 | 00,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2009.10.29 19:12:26 | 00,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img
[2009.10.29 18:01:48 | 00,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Marion\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.27 18:51:25 | 00,000,869 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 4.lnk
[2009.10.27 18:01:38 | 00,010,588 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\kofy.pif
[2009.10.25 16:10:08 | 00,019,173 | ---- | C] () -- C:\WINDOWS\System32\zohysom.lib
[2009.10.15 05:11:40 | 00,012,389 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kupyvuwotu.scr
[2009.10.12 05:03:22 | 00,010,946 | ---- | C] () -- C:\WINDOWS\puciz.com
[2009.10.08 05:02:48 | 00,016,671 | ---- | C] () -- C:\WINDOWS\bulumacebo.dat
[2009.10.06 05:47:31 | 00,018,509 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eraqoc._dl
[2009.10.06 05:47:31 | 00,018,378 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\qagos.com
[2009.10.06 05:47:31 | 00,016,925 | ---- | C] () -- C:\WINDOWS\opohyhi.com
[2009.10.06 05:47:31 | 00,016,908 | ---- | C] () -- C:\WINDOWS\xasygufap.exe
[2009.10.06 05:47:31 | 00,016,538 | ---- | C] () -- C:\WINDOWS\gerowetage.com
[2009.10.06 05:47:31 | 00,016,277 | ---- | C] () -- C:\WINDOWS\utosywer.inf
[2009.10.06 05:47:31 | 00,016,111 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\bytybofix.ban
[2009.10.06 05:47:31 | 00,015,357 | ---- | C] () -- C:\Programme\Gemeinsame Dateien\edalyk.bin
[2009.10.06 05:47:31 | 00,014,840 | ---- | C] () -- C:\WINDOWS\okygan.db
[2009.10.06 05:47:31 | 00,014,749 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\ymecebep.bat
[2009.10.06 05:47:31 | 00,014,122 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\aqytepozin.inf
[2009.10.06 05:47:31 | 00,013,645 | ---- | C] () -- C:\WINDOWS\System32\ugusy.reg
[2009.10.06 05:47:31 | 00,013,439 | ---- | C] () -- C:\WINDOWS\itetinune.sys
[2009.10.06 05:47:31 | 00,012,533 | ---- | C] () -- C:\WINDOWS\junuqax.dat
[2009.10.06 05:47:31 | 00,012,306 | ---- | C] () -- C:\WINDOWS\System32\zawynykus.com
[2009.10.06 05:47:31 | 00,011,397 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\otetoli._sy
[2009.10.06 05:47:31 | 00,010,349 | ---- | C] () -- C:\WINDOWS\alidi.inf
[2009.10.06 05:47:31 | 00,010,083 | ---- | C] () -- C:\WINDOWS\atavu.dll
[2009.05.22 08:34:10 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.04.08 19:56:30 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2009.04.06 19:00:20 | 00,000,662 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpzinstall.log
[2009.04.01 17:41:10 | 00,000,062 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\desktop.ini
[2009.04.01 17:34:18 | 00,007,168 | ---- | C] () -- C:\WINDOWS\suecmdial.dll
[2009.04.01 17:12:56 | 05,343,776 | -H-- | C] () -- C:\Dokumente und Einstellungen\Marion\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2009.04.01 17:11:11 | 00,356,352 | R--- | C] () -- C:\WINDOWS\EMCRI.dll
[2009.04.01 17:09:54 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2009.04.01 17:07:41 | 00,036,296 | ---- | C] () -- C:\Dokumente und Einstellungen\Marion\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2009.04.01 17:02:12 | 00,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2009.04.01 17:00:51 | 00,000,062 | -HS- | C] () -- C:\Dokumente und Einstellungen\Marion\Anwendungsdaten\desktop.ini
[2006.02.28 13:00:00 | 00,000,582 | ---- | C] () -- C:\WINDOWS\win.ini
[2006.02.28 13:00:00 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini
[2001.07.07 02:00:00 | 00,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
< End of report >
|
|
31.10.2009, 20:21
| #22 |
| | Wie kann ich diese Viren entfernen? OTL Extras: Code:
ATTFilter OTL Extras logfile created on: 31.10.2009 20:12:13 - Run 4
OTL by OldTimer - Version 3.1.1.6 Folder = C:\Dokumente und Einstellungen\Marion\Eigene Dateien\Downloads\Antiviren
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
446,11 Mb Total Physical Memory | 169,28 Mb Available Physical Memory | 37,95% Memory free
1,03 Gb Paging File | 0,89 Gb Available in Paging File | 86,25% Paging File free
Paging file location(s): C:\pagefile.sys 674 674 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 64,71 Gb Free Space | 86,84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: TEST-112
Current User Name: Marion
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- C:\WINDOWS\hh.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Programme\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
chm.file [open] -- "C:\WINDOWS\hh.exe" %1 (Microsoft Corporation)
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Programme\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Programme\Internet Explorer\iexplore.exe" (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" =
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"4764:TCP" = 4764:TCP:*:Disabled:ikjkrzap
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\TeamViewer\Version4\TeamViewer.exe" = C:\Programme\TeamViewer\Version4\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Disabled:hpoews01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Programme\HP\Digital Imaging\bin\hpofxm08.exe:*:Disabled:hpofxm08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hposfx08.exe" = C:\Programme\HP\Digital Imaging\bin\hposfx08.exe:*:Disabled:hposfx08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Disabled:hposid01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpqCopy.exe:*:Disabled:hpqcopy.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Disabled:hpqkygrp.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqnrs08.exe:*:Disabled:hpqnrs08.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Programme\HP\Digital Imaging\bin\hpqscnvw.exe:*:Disabled:hpqscnvw.exe -- ()
"C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Programme\HP\Digital Imaging\bin\hpzwiz01.exe:*:Disabled:hpzwiz01.exe -- (Hewlett-Packard Development Company, L.P.)
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe" = C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76EA55BD-535F-4AB4-AD80-A8CA331F4E6F}" = Windows Messenger 5.1
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{873A44EE-145C-4202-9844-4BE83AF3E228}" = HotKey_Driver
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_STANDARD_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_STANDARD_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARD_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARD_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_STANDARD_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_STANDARD_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{94C5F3DC-7891-42BA-8F14-1D689DD972B7}" = Kartendesigner - Einladung & Party
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Free Antivirus
"Defraggler" = Defraggler
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.5.4)" = Mozilla Firefox (3.5.4)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero8Lite_is1" = Nero 8 Micro 8.3.6.0
"SMSERIAL" = Motorola SM56 Data Fax Modem
"STANDARD" = Microsoft Office Standard 2007
"TeamViewer 4" = TeamViewer 4
"VIA/S3G UniChrome Family Win2K/XP/Server2003 Display" = VIA/S3G Display Driver 6.14.10.0331
"VLC media player" = VLC media player 1.0.2
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"xp-AntiSpy" = xp-AntiSpy 3.97-3
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 30.10.2009 06:19:59 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
Error - 30.10.2009 06:19:59 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
Error - 30.10.2009 06:19:59 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
Error - 30.10.2009 06:19:59 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
Error - 30.10.2009 06:24:59 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
Error - 30.10.2009 06:31:03 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
Error - 30.10.2009 06:31:04 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
Error - 30.10.2009 06:36:05 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
Error - 30.10.2009 06:41:06 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
Error - 30.10.2009 06:41:07 | Computer Name = TEST-112 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
[ System Events ]
Error - 30.10.2009 20:26:36 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Image Manager" wurde mit folgendem Fehler beendet: %%126
Error - 30.10.2009 21:08:15 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update Service (gupdate1c9b2e728892258)" wurde
aufgrund folgenden Fehlers nicht gestartet: %%3
Error - 30.10.2009 21:08:15 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Image Manager" wurde mit folgendem Fehler beendet: %%126
Error - 30.10.2009 23:27:42 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update Service (gupdate1c9b2e728892258)" wurde
aufgrund folgenden Fehlers nicht gestartet: %%3
Error - 30.10.2009 23:27:42 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Image Manager" wurde mit folgendem Fehler beendet: %%126
Error - 30.10.2009 23:28:11 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7034
Description = Dienst "Pml Driver HPZ12" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 31.10.2009 07:39:49 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update Service (gupdate1c9b2e728892258)" wurde
aufgrund folgenden Fehlers nicht gestartet: %%3
Error - 31.10.2009 07:39:49 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Image Manager" wurde mit folgendem Fehler beendet: %%126
Error - 31.10.2009 07:50:28 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update Service (gupdate1c9b2e728892258)" wurde
aufgrund folgenden Fehlers nicht gestartet: %%3
Error - 31.10.2009 07:50:28 | Computer Name = TEST-112 | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Image Manager" wurde mit folgendem Fehler beendet: %%126
< End of report >
|
|
31.10.2009, 20:45
| #23 |
| /// Selecta Jahrusso | Wie kann ich diese Viren entfernen? schritt 1 Während dieser Scans soll(en):
schritt 2 Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen Code:
ATTFilter C:\WINDOWS\opohyhi.com
C:\WINDOWS\xasygufap.exe
C:\WINDOWS\atavu.dll
C:\WINDOWS\itetinune.sys
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
31.10.2009, 21:45
| #24 |
| | Wie kann ich diese Viren entfernen? Rootkitscan mit RootRepeal: Code:
ATTFilter ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/10/31 21:14
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF5DAC000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B4C000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF16B4000 Size: 49152 File Visible: No Signed: -
Status: -
==EOF==
Virustotal: Wenn ich auf Filter klicke auf was muss ich jetzt klicken? EDIT: Keine der 4 Dateien ist befallen dort steht immer 0/40 oder 0/41. Kein Scanner schlägt Alarm. Code:
ATTFilter Datei opohyhi.com empfangen 2009.10.31 20:36:14 (UTC)
Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.41 2009.10.31 -
AhnLab-V3 5.0.0.2 2009.10.30 -
AntiVir 7.9.1.53 2009.10.30 -
Antiy-AVL 2.0.3.7 2009.10.30 -
Authentium 5.1.2.4 2009.10.31 -
Avast 4.8.1351.0 2009.10.30 -
AVG 8.5.0.423 2009.10.31 -
BitDefender 7.2 2009.10.31 -
CAT-QuickHeal 10.00 2009.10.31 -
ClamAV 0.94.1 2009.10.31 -
Comodo 2796 2009.10.31 -
DrWeb 5.0.0.12182 2009.10.31 -
eSafe 7.0.17.0 2009.10.29 -
eTrust-Vet 35.1.7094 2009.10.30 -
F-Prot 4.5.1.85 2009.10.31 -
Fortinet 3.120.0.0 2009.10.31 -
GData 19 2009.10.31 -
Ikarus T3.1.1.72.0 2009.10.31 -
Jiangmin 11.0.800 2009.10.31 -
K7AntiVirus 7.10.885 2009.10.31 -
Kaspersky 7.0.0.125 2009.10.31 -
McAfee 5788 2009.10.31 -
McAfee+Artemis 5788 2009.10.31 -
McAfee-GW-Edition 6.8.5 2009.10.31 -
Microsoft 1.5202 2009.10.31 -
NOD32 4561 2009.10.31 -
Norman 6.03.02 2009.10.31 -
nProtect 2009.1.8.0 2009.10.31 -
Panda 10.0.2.2 2009.10.31 -
PCTools 7.0.3.5 2009.10.30 -
Prevx 3.0 2009.10.31 -
Rising 21.53.52.00 2009.10.31 -
Sophos 4.47.0 2009.10.31 -
Sunbelt 3.2.1858.2 2009.10.31 -
Symantec 1.4.4.12 2009.10.31 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.10.31 -
VBA32 3.12.10.11 2009.10.30 -
ViRobot 2009.10.31.2015 2009.10.31 -
VirusBuster 4.6.5.0 2009.10.31 -
weitere Informationen
File size: 16925 bytes
MD5...: 5267b707d7136578a5d730c999a369df
SHA1..: 4c381214bb822ce3f198ff906d459b8becbd897e
SHA256: 20f9ef1746f9631919448fb15140c92b0b8b83257e3415808a13be4ebf4f85bc
ssdeep: 384:u7NdoIbaAcFtHh3CKwWkLpPfhH9THrOp60Yus3mhm37+4aOKpbaXM19Vmu:K<br>wtBqDL9TvNus2hm37ifdnrl<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: Unknown!
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
Code:
ATTFilter Datei xasygufap.exe empfangen 2009.10.31 20:45:25 (UTC)
Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.41 2009.10.31 -
AhnLab-V3 5.0.0.2 2009.10.30 -
AntiVir 7.9.1.53 2009.10.30 -
Antiy-AVL 2.0.3.7 2009.10.30 -
Authentium 5.1.2.4 2009.10.31 -
Avast 4.8.1351.0 2009.10.30 -
AVG 8.5.0.423 2009.10.31 -
BitDefender 7.2 2009.10.31 -
CAT-QuickHeal 10.00 2009.10.31 -
ClamAV 0.94.1 2009.10.31 -
Comodo 2796 2009.10.31 -
DrWeb 5.0.0.12182 2009.10.31 -
eSafe 7.0.17.0 2009.10.29 -
eTrust-Vet 35.1.7094 2009.10.30 -
F-Prot 4.5.1.85 2009.10.31 -
F-Secure 9.0.15370.0 2009.10.30 -
Fortinet 3.120.0.0 2009.10.31 -
GData 19 2009.10.31 -
Ikarus T3.1.1.72.0 2009.10.31 -
Jiangmin 11.0.800 2009.10.31 -
K7AntiVirus 7.10.885 2009.10.31 -
Kaspersky 7.0.0.125 2009.10.31 -
McAfee 5788 2009.10.31 -
McAfee+Artemis 5788 2009.10.31 -
McAfee-GW-Edition 6.8.5 2009.10.31 -
Microsoft 1.5202 2009.10.31 -
NOD32 4561 2009.10.31 -
Norman 6.03.02 2009.10.31 -
nProtect 2009.1.8.0 2009.10.31 -
Panda 10.0.2.2 2009.10.31 -
PCTools 7.0.3.5 2009.10.30 -
Prevx 3.0 2009.10.31 -
Rising 21.53.52.00 2009.10.31 -
Sophos 4.47.0 2009.10.31 -
Sunbelt 3.2.1858.2 2009.10.31 -
Symantec 1.4.4.12 2009.10.31 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.10.31 -
VBA32 3.12.10.11 2009.10.30 -
ViRobot 2009.10.31.2015 2009.10.31 -
VirusBuster 4.6.5.0 2009.10.31 -
weitere Informationen
File size: 16908 bytes
MD5...: 3a3d128ad390d9dafcaf527a6b479d92
SHA1..: 9ae6171717c2aab3947860d26b47a75d803a5098
SHA256: 294f9ef46ae07dbe41747954d63cb2bd2ed5565bab9c9ef911999501a3b608f9
ssdeep: 384:DFM73vrzXc00oYtdNWwjnpJqHeCNaHMnWmfXnXRZijaPG0Rwgk3:D+brzc0b<br>Ax4vXRZo/0uH3<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: MPEG Video (100.0%)
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
Code:
ATTFilter Datei atavu.dll empfangen 2009.10.31 20:46:44 (UTC)
Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.41 2009.10.31 -
AhnLab-V3 5.0.0.2 2009.10.30 -
AntiVir 7.9.1.53 2009.10.30 -
Antiy-AVL 2.0.3.7 2009.10.30 -
Authentium 5.1.2.4 2009.10.31 -
Avast 4.8.1351.0 2009.10.30 -
AVG 8.5.0.423 2009.10.31 -
BitDefender 7.2 2009.10.31 -
CAT-QuickHeal 10.00 2009.10.31 -
ClamAV 0.94.1 2009.10.31 -
Comodo 2796 2009.10.31 -
DrWeb 5.0.0.12182 2009.10.31 -
eSafe 7.0.17.0 2009.10.29 -
eTrust-Vet 35.1.7094 2009.10.30 -
F-Prot 4.5.1.85 2009.10.31 -
F-Secure 9.0.15370.0 2009.10.30 -
Fortinet 3.120.0.0 2009.10.31 -
GData 19 2009.10.31 -
Ikarus T3.1.1.72.0 2009.10.31 -
Jiangmin 11.0.800 2009.10.31 -
K7AntiVirus 7.10.885 2009.10.31 -
Kaspersky 7.0.0.125 2009.10.31 -
McAfee 5788 2009.10.31 -
McAfee+Artemis 5788 2009.10.31 -
McAfee-GW-Edition 6.8.5 2009.10.31 -
Microsoft 1.5202 2009.10.31 -
NOD32 4561 2009.10.31 -
Norman 6.03.02 2009.10.31 -
nProtect 2009.1.8.0 2009.10.31 -
Panda 10.0.2.2 2009.10.31 -
PCTools 7.0.3.5 2009.10.30 -
Prevx 3.0 2009.10.31 -
Rising 21.53.52.00 2009.10.31 -
Sophos 4.47.0 2009.10.31 -
Sunbelt 3.2.1858.2 2009.10.31 -
Symantec 1.4.4.12 2009.10.31 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.10.31 -
VBA32 3.12.10.11 2009.10.30 -
ViRobot 2009.10.31.2015 2009.10.31 -
VirusBuster 4.6.5.0 2009.10.31 -
weitere Informationen
File size: 10083 bytes
MD5...: 73af8e771afa9a8db37646a2575e9702
SHA1..: 7d81e0949efe802fbdd4d0edcc49b411eccbeb02
SHA256: 01f8e107706658dd311f7530360ec04438e12a0b2f3c64c49036e1b044c2db90
ssdeep: 192:I4eRB7usSNMC9E6UkE2L8mRUmjef0kTsISSG7T+Cc:PetjCysEKjUi6wSoc<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
trid..: Unknown!
Code:
ATTFilter Datei itetinune.sys empfangen 2009.10.31 20:47:37 (UTC)
Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.41 2009.10.31 -
AhnLab-V3 5.0.0.2 2009.10.30 -
AntiVir 7.9.1.53 2009.10.30 -
Antiy-AVL 2.0.3.7 2009.10.30 -
Authentium 5.1.2.4 2009.10.31 -
Avast 4.8.1351.0 2009.10.30 -
AVG 8.5.0.423 2009.10.31 -
BitDefender 7.2 2009.10.31 -
CAT-QuickHeal 10.00 2009.10.31 -
ClamAV 0.94.1 2009.10.31 -
Comodo 2796 2009.10.31 -
DrWeb 5.0.0.12182 2009.10.31 -
eSafe 7.0.17.0 2009.10.29 -
eTrust-Vet 35.1.7094 2009.10.30 -
F-Prot 4.5.1.85 2009.10.31 -
F-Secure 9.0.15370.0 2009.10.30 -
Fortinet 3.120.0.0 2009.10.31 -
GData 19 2009.10.31 -
Ikarus T3.1.1.72.0 2009.10.31 -
Jiangmin 11.0.800 2009.10.31 -
K7AntiVirus 7.10.885 2009.10.31 -
Kaspersky 7.0.0.125 2009.10.31 -
McAfee 5788 2009.10.31 -
McAfee+Artemis 5788 2009.10.31 -
McAfee-GW-Edition 6.8.5 2009.10.31 -
Microsoft 1.5202 2009.10.31 -
NOD32 4561 2009.10.31 -
Norman 6.03.02 2009.10.31 -
nProtect 2009.1.8.0 2009.10.31 -
Panda 10.0.2.2 2009.10.31 -
PCTools 7.0.3.5 2009.10.30 -
Prevx 3.0 2009.10.31 -
Rising 21.53.52.00 2009.10.31 -
Sophos 4.47.0 2009.10.31 -
Sunbelt 3.2.1858.2 2009.10.31 -
Symantec 1.4.4.12 2009.10.31 -
TheHacker 6.5.0.2.058 2009.10.31 -
TrendMicro 8.950.0.1094 2009.10.31 -
VBA32 3.12.10.11 2009.10.30 -
ViRobot 2009.10.31.2015 2009.10.31 -
VirusBuster 4.6.5.0 2009.10.31 -
weitere Informationen
File size: 13439 bytes
MD5...: e5c21b6f3475a03cbd06aab9c0a87b29
SHA1..: 0444c9d40aeb7055a9e22028657e607b94a4a002
SHA256: 79efb543b2d7490b3fb57cecfc6d51b17a36a3cd7b679f3f922392883a42f08a
ssdeep: 384:BuSwFZVQHuTw+vWvWNmlXYeEcUX7qBvdV97:EFM3KW+NHzLqBlV97<br>
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set<br>-
pdfid.: -
trid..: MPEG Video (100.0%)
sigcheck:<br>publisher....: n/a<br>copyright....: n/a<br>product......: n/a<br>description..: n/a<br>original name: n/a<br>internal name: n/a<br>file version.: n/a<br>comments.....: n/a<br>signers......: -<br>signing date.: -<br>verified.....: Unsigned<br>
Geändert von Runner (31.10.2009 um 21:55 Uhr) |
|
31.10.2009, 22:04
| #25 |
| /// Selecta Jahrusso | Wie kann ich diese Viren entfernen? schritt 1 Grundreinigung mit SUPERAntiSpyware
schritt 2
schritt 3 Schliesse bitte alle laufenden Programme inkl Browser. Lösche bitte die Extra.txt von Deinem Desktop. Doppelklick auf die OTL.exe und poste beide Logfiles. Berichte ob der Rechner noch Probleme macht.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
01.11.2009, 00:46
| #26 |
| | Wie kann ich diese Viren entfernen? SUPERAntiSpyware Code:
ATTFilter SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 10/31/2009 at 10:39 PM
Application Version : 4.29.1004
Core Rules Database Version : 4217
Trace Rules Database Version: 2122
Scan type : Complete Scan
Total Scan Time : 00:22:14
Memory items scanned : 386
Memory threats detected : 0
Registry items scanned : 4032
Registry threats detected : 11
File items scanned : 11598
File threats detected : 3
Rogue.XP AntiSpyware 2009
HKU\.DEFAULT\Control Panel\don't load#wscui.cpl [ No ]
HKU\S-1-5-18\Control Panel\don't load#wscui.cpl [ No ]
Trojan.Agent/Gen-AlerterALG
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALERTERALG\0000#DeviceDesc
Rootkit.Agent/Gen-UAC
C:\WINDOWS\SYSTEM32\UACPYMECBNREQ.LOG
Adware.Tracking Cookie
C:\WINDOWS\system32\config\systemprofile\Cookies\system@www.exerevenue[1].txt
Trojan.Agent/Gen-Dropper[Temp]
C:\WINDOWS\TEMP\9.TMP
ESET Online Scanner Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6050
# api_version=3.0.2
# EOSSerial=d8bc40a96898af4eb6dce55101431992
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-10-31 10:37:08
# local_time=2009-10-31 11:37:08 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# scanned=23837
# found=4
# cleaned=4
# scan_time=1957
C:\Dokumente und Einstellungen\Marion\Lokale Einstellungen\Temp\7zSC.tmp\data\WindowsXP-KB973354-x86-DEU.exe probably unknown NewHeur_PE virus (deleted - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\_avast5_\unp117217950.tmp\File0041.tmp probably unknown NewHeur_PE virus (deleted - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\_avast5_\unp253384774.tmp\File0041.tmp probably unknown NewHeur_PE virus (deleted - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\Temp\_avast5_\unp34011912.tmp\File0041.tmp probably unknown NewHeur_PE virus (deleted - quarantined) 00000000000000000000000000000000 C
|
|
01.11.2009, 00:55
| #27 |
| /// Selecta Jahrusso | Wie kann ich diese Viren entfernen? Ich möchte noch etwas graben  Rootkitsuche mit Avira AntiRootkit Lade Avira AntiRootkit herunter, indem Du auf den Download-Button klickst. Speichere die Datei auf Deinem Desktop.
schritt 2 Rootkitsuche mit SysProt
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
01.11.2009, 18:47
| #28 |
| | Wie kann ich diese Viren entfernen? Rootkitsuche mit Avira AntiRootkit Code:
ATTFilter Avira AntiRootkit Tool (1.1.0.1)
========================================================================================================
- Scan started Sonntag, 1. November 2009 - 18:41:14
========================================================================================================
--------------------------------------------------------------------------------------------------------
Configuration:
--------------------------------------------------------------------------------------------------------
- [X] Scan files
- [X] Scan registry
- [X] Scan processes
- [ ] Fast scan
- Working disk total size : 74.52 GB
- Working disk free size : 66.56 GB (89 %)
--------------------------------------------------------------------------------------------------------
Results:
Hidden key : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SKYNETiornssfv\main
Hidden key : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SKYNETiornssfv\modules
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SKYNETiornssfv -> start
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SKYNETiornssfv -> type
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SKYNETiornssfv -> group
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SKYNETiornssfv -> imagepath
Hidden key : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\UACd.sys\modules
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\UACd.sys -> start
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\UACd.sys -> type
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\UACd.sys -> imagepath
Hidden value : HKEY_LOCAL_MACHINE\System\ControlSet002\Services\UACd.sys -> group
--------------------------------------------------------------------------------------------------------
Files: 0/25231
Registry items: 11/176475
Processes: 0/24
Scan time: 00:02:46
--------------------------------------------------------------------------------------------------------
Active processes:
- kvmvwjrg.exe (PID 2096) (Avira AntiRootkit Tool)
- System (PID 4)
- smss.exe (PID 348)
- csrss.exe (PID 632)
- winlogon.exe (PID 656)
- services.exe (PID 700)
- lsass.exe (PID 712)
- svchost.exe (PID 872)
- svchost.exe (PID 932)
- svchost.exe (PID 972)
- svchost.exe (PID 1040)
- svchost.exe (PID 1100)
- explorer.exe (PID 1480)
- spoolsv.exe (PID 1508)
- sched.exe (PID 1596)
- avgnt.exe (PID 1632)
- avguard.exe (PID 1716)
- svchost.exe (PID 1756)
- mdm.exe (PID 440)
- HPZipm12.exe (PID 464)
- svchost.exe (PID 516)
- alg.exe (PID 1872)
- avcenter.exe (PID 1428)
- avirarkd.exe (PID 916)
========================================================================================================
- Scan finished Sonntag, 1. November 2009 - 18:44:01
========================================================================================================
EDIT: Was mir auffällt sind ein paar Schlüssel die mit dem Wise Regestry Cleaner immer wieder auftauchen und nicht zu löschen sind. An nem anderen PC tauchen diese Werte nicht immer wieder auf. Datei im Anhang. Geändert von Runner (01.11.2009 um 19:00 Uhr) |
|
01.11.2009, 19:17
| #29 |
| /// Selecta Jahrusso | Wie kann ich diese Viren entfernen? Scan mit SystemLook Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. Download Mirror #1 - Download Mirror #2
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
01.11.2009, 19:19
| #30 |
| | Wie kann ich diese Viren entfernen? System Look Scan Code:
ATTFilter SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 19:19 on 01/11/2009 by Marion (Administrator - Elevation successful)
========== reg ==========
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SKYNETiornssfv]
(Unable to open key - access denied)
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\UACd.sys]
(Unable to open key - access denied)
-=End Of File=-
|
|
| Themen zu Wie kann ich diese Viren entfernen? |
| 7 viren, anfang, antivir, automatische, autostart, avast, avast!, avg, c:\windows\temp, einstellungen, entfernen, f-secure, fehler, gen, gupdate, hijack, hijackthis, hkus\s-1-5-18, laptop, linux, microsoft, nicht mehr, nicht öffnen, rechner, sdra64.exe, seite, seiten, sicherheitscenter, software, sp3, updates, userinit.exe, viren, viren entfernen, windows, windows\temp, öffnen |
Linear-Darstellung
