| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Rätselhafter Prozess deanapi.exe ?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
30.12.2009, 18:55
| #1 |
 |  Rätselhafter Prozess deanapi.exe ? Hallo, vor ein paar Tagen meldete Antivir den Trojaner TR/Buzus.cven. Nachdem ich ihn in Quarantäne schob, war auch endlich Ruhe. Um nochmal alles zu checken wollte ich mir die 30 Tage Testversion von Kaspersky herunterladen, was ich dann auch tat, jedoch hängte sich das Installationsprogramm irgendwann auf. Ich öffnete daraufhin den Taskmanager und beendete das Setup. Dabei bemerkte ich diesen merkwürdigen Prozess, von dem ich noch nie was gehört hatte, selbst Google lieferte dazu genau 0 Ergebnisse. Der Prozess heißt deanapi.exe und ich konnte die restlichen Informationen zu dem Prozess leider nicht LESEN, da alles in kyrillisch verfasst war. Woher kommt dieser Prozess? Habe ich den TR/Buzus.cven doch nicht ganz entfernen können? Bitte um schnelle Antwort  |
|
30.12.2009, 21:23
| #2 |
  |  Rätselhafter Prozess deanapi.exe ?__________________
__________________ |
|
31.12.2009, 16:22
| #3 |
| | Rätselhafter Prozess deanapi.exe ? Hallo, hier nachgereicht der HijackThis Log:
__________________Logfile of random's system information tool 1.06 (written by random/random) Run by User at 2009-12-31 16:21:10 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 34 GB (30%) free of 114 GB Total RAM: 1791 MB (51% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:21:27, on 31.12.2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Windows\RtHDVCpl.exe C:\Acer\Empowering Technology\SysMonitor.exe C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\System32\mobsync.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\NOTEPAD.EXE C:\Users\User\Desktop\RSIT.exe C:\Program Files\trend micro\User.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Yahoo! Deutschland R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! Deutschland R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! Deutschland R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! Deutschland R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: (no name) - - (no file) O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [IS CfgWiz] "c:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user') O4 - Global Startup: Empowering Technology Launcher.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Per Mitteilung versenden(&M) ... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm O8 - Extra context menu item: Über Bluetooth senden - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O13 - Gopher Prefix: O17 - HKLM\System\CCS\Services\Tcpip\..\{D3F648DF-AC32-459E-BDD6-A970C49E3D9A}: NameServer = 213.191.74.11 213.191.92.82 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\xampp\apache\bin\httpd.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe O23 - Service: Google Update Service (gupdate1ca08906755b8aa) (gupdate1ca08906755b8aa) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\Common Files\NMSAccessU.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 11905 bytes ======Scheduled tasks folder====== C:\Windows\tasks\Google Software Updater.job C:\Windows\tasks\GoogleUpdateTaskMachineCore.job C:\Windows\tasks\GoogleUpdateTaskMachineUA.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}] c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-11-21 96984] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}] ShowBarObj Class - C:\Windows\system32\ActiveToolBand.dll [2007-04-25 299008] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-07-19 668656] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}] HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2007-11-06 542016] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-04-25 151552] {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - Veoh Web Player Video Finder - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll [2009-08-20 430592] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184] "StartCCC"=c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112] "ccApp"=c:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-11-21 107112] "IS CfgWiz"=c:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE REBOOT [] "PCMMediaSharing"=C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-06-21 204908] "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-06-20 4493312] "Acer Empowering Technology Monitor"=C:\Acer\Empowering Technology\SysMonitor.exe [2007-07-31 326176] "eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-04-25 457216] "Acer Tour"= [] "WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344] "eRecoveryService"= [] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280] "NPSStartup"= [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-12-30 429392] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2009-07-26 3883840] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240] "AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2009-04-07 102400] "SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-12-16 2002160] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe [2007-05-22 151552] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoRun] C:\Program Files\BEWERBUNGSMASTER\UpdateCheck_BEWERBUNGSMASTER.exe [2009-09-25 102400] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BtTray] C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe [2008-08-04 226816] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe [2009-09-03 3342336] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-10-14 49152] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-06-02 80896] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] C:\PROGRA~1\ICQ6\ICQ.exe silent [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\matf.de updater] C:\Program Files\Common Files\matf_update\matf_updater.exe [2008-06-22 1084416] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck] c:\Program Files\Norton Internet Security\osCheck.exe [2006-11-21 22696] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza] C:\Program Files\Shareaza\Shareaza.exe [2008-10-01 5723136] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe [2009-08-20 2000120] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2009-05-26 85160] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [2008-08-04 36352] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk] C:\PROGRA~1\OPENOF~1.4\program\QUICKS~1.EXE [2008-01-21 393216] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SAM.lnk] C:\Program Files\SAM\SAM.exe [] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "LogonHoursAction"=2 "DontDisplayLogonHoursWarnings"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "EnableLUA"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Users\User\AppData\Local\Temp\IXP000.TMP\gdfgdf.exe"="C:\Users\User\AppData\Local\Temp\IXP000.TMP\gdfgdf.exe:*:Enabled:Firevall Administrating" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1606571d-93d6-11de-9145-ac7208ce16cc}] shell\AutoRun\command - H:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1dc955d4-f9c8-11dd-86ba-001167c79378}] shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fbcc5aa6-0353-11de-8286-001167c79378}] shell\AutoRun\command - H:\LaunchU3.exe -a ======File associations====== .scr - open - "C:\Windows\system32\NOTEPAD.EXE" "%1" .scr - install - .scr - config - ======List of files/folders created in the last 1 months====== 2009-12-30 18:16:09 ----D---- C:\ProgramData\Kaspersky Lab Setup Files 2009-12-30 14:33:07 ----D---- C:\Windows\system32\eu-ES 2009-12-30 14:33:07 ----D---- C:\Windows\system32\ca-ES 2009-12-30 14:33:04 ----D---- C:\Windows\system32\vi-VN 2009-12-30 13:52:10 ----D---- C:\Windows\system32\EventProviders 2009-12-28 13:53:26 ----D---- C:\ProgramData\SUPERAntiSpyware.com 2009-12-28 13:51:48 ----D---- C:\Users\User\AppData\Roaming\SUPERAntiSpyware.com 2009-12-28 13:51:48 ----D---- C:\Program Files\SUPERAntiSpyware 2009-12-28 13:50:25 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2009-12-26 15:38:57 ----D---- C:\Program Files\trend micro 2009-12-26 15:38:56 ----D---- C:\rsit 2009-12-26 00:05:18 ----D---- C:\Users\User\AppData\Roaming\Malwarebytes 2009-12-26 00:05:10 ----D---- C:\ProgramData\Malwarebytes 2009-12-26 00:05:09 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-12-25 23:56:31 ----D---- C:\Program Files\CCleaner 2009-12-25 15:01:39 ----D---- C:\Users\User\AppData\Roaming\PC Suite 2009-12-25 15:01:39 ----D---- C:\ProgramData\PC Suite 2009-12-25 14:56:54 ----A---- C:\Windows\system32\nmwcdcls.dll 2009-12-25 14:56:44 ----DC---- C:\Windows\system32\DRVSTORE 2009-12-25 14:55:37 ----D---- C:\Windows\system32\Samsung_USB_Drivers 2009-12-25 14:55:13 ----A---- C:\Windows\system32\FsUsbExService.Exe 2009-12-25 14:55:13 ----A---- C:\Windows\system32\FsUsbExDevice.Dll 2009-12-25 14:54:54 ----D---- C:\Users\User\AppData\Roaming\Samsung 2009-12-25 14:54:26 ----D---- C:\Program Files\MarkAny 2009-12-25 14:54:23 ----D---- C:\Program Files\PC Connectivity Solution 2009-12-25 14:53:26 ----D---- C:\Program Files\Samsung 2009-12-25 14:14:34 ----D---- C:\Program Files\Common Files\DVDVideoSoft 2009-12-25 14:14:33 ----D---- C:\Program Files\DVDVideoSoft 2009-12-25 14:08:53 ----D---- C:\Program Files\YouTube Downloader 2009-12-12 20:03:05 ----A---- C:\Windows\system32\javaws.exe 2009-12-12 20:03:05 ----A---- C:\Windows\system32\javaw.exe 2009-12-12 20:03:05 ----A---- C:\Windows\system32\java.exe 2009-12-10 21:57:04 ----A---- C:\Windows\system32\nshhttp.dll 2009-12-10 21:57:02 ----A---- C:\Windows\system32\httpapi.dll 2009-12-09 17:23:35 ----A---- C:\Windows\system32\mshtml.dll 2009-12-09 17:23:34 ----A---- C:\Windows\system32\ieframe.dll 2009-12-09 17:23:33 ----A---- C:\Windows\system32\wininet.dll 2009-12-09 17:23:32 ----A---- C:\Windows\system32\urlmon.dll 2009-12-09 17:23:31 ----A---- C:\Windows\system32\ieapfltr.dll 2009-12-09 17:23:30 ----A---- C:\Windows\system32\ieui.dll 2009-12-09 17:23:30 ----A---- C:\Windows\system32\ieencode.dll 2009-12-09 17:21:32 ----A---- C:\Windows\system32\winhttp.dll 2009-12-09 17:05:22 ----A---- C:\Windows\system32\rastls.dll 2009-12-08 21:34:37 ----D---- C:\Program Files\QuickTime 2009-12-08 21:34:36 ----D---- C:\ProgramData\Apple Computer 2009-12-08 21:33:42 ----D---- C:\Program Files\Common Files\Apple 2009-12-08 21:33:26 ----D---- C:\ProgramData\Apple 2009-12-08 21:33:26 ----D---- C:\Program Files\Apple Software Update 2009-12-06 14:00:19 ----D---- C:\Program Files\GIMP-2.0 ======List of files/folders modified in the last 1 months====== 2009-12-31 16:21:18 ----D---- C:\Windows\Temp 2009-12-31 16:20:06 ----D---- C:\Windows\tracing 2009-12-31 14:46:22 ----D---- C:\Windows\Tasks 2009-12-31 14:06:29 ----D---- C:\Windows\system32\drivers 2009-12-31 13:32:52 ----D---- C:\Windows\winsxs 2009-12-31 13:32:50 ----D---- C:\Windows\system32\catroot 2009-12-31 13:32:28 ----D---- C:\Windows\system32\catroot2 2009-12-31 13:27:53 ----SHD---- C:\System Volume Information 2009-12-31 13:27:05 ----D---- C:\Windows\System32 2009-12-31 13:27:05 ----A---- C:\Windows\system32\PerfStringBackup.INI 2009-12-31 13:26:58 ----D---- C:\Windows\inf 2009-12-31 13:24:46 ----D---- C:\Program Files\Mozilla Firefox 2009-12-30 19:08:03 ----SHD---- C:\Windows\Installer 2009-12-30 18:54:42 ----D---- C:\Users\User\AppData\Roaming\OpenOffice.org2 2009-12-30 18:48:41 ----D---- C:\Windows\Prefetch 2009-12-30 18:19:18 ----HD---- C:\Config.Msi 2009-12-30 18:19:17 ----D---- C:\Program Files\Norton Internet Security 2009-12-30 18:19:15 ----D---- C:\Program Files\Common Files\Symantec Shared 2009-12-30 18:18:48 ----HD---- C:\ProgramData 2009-12-30 18:18:48 ----D---- C:\Program Files\Symantec 2009-12-30 16:10:30 ----D---- C:\Windows\Microsoft.NET 2009-12-30 16:10:14 ----RSD---- C:\Windows\assembly 2009-12-30 15:51:28 ----D---- C:\Program Files\Spybot - Search & Destroy 2009-12-30 15:40:14 ----D---- C:\ProgramData\Spybot - Search & Destroy 2009-12-30 14:56:30 ----D---- C:\Windows\rescache 2009-12-30 14:43:16 ----D---- C:\Windows 2009-12-30 14:43:11 ----SHD---- C:\Boot 2009-12-30 14:35:12 ----D---- C:\Program Files\Windows Mail 2009-12-30 14:35:12 ----D---- C:\Program Files\Windows Calendar 2009-12-30 14:35:12 ----D---- C:\Program Files\Movie Maker 2009-12-30 14:35:09 ----D---- C:\Program Files\Windows Sidebar 2009-12-30 14:35:09 ----D---- C:\Program Files\Internet Explorer 2009-12-30 14:35:08 ----D---- C:\Program Files\Windows Media Player 2009-12-30 14:35:08 ----D---- C:\Program Files\Windows Journal 2009-12-30 14:35:08 ----D---- C:\Program Files\Windows Collaboration 2009-12-30 14:35:05 ----D---- C:\Program Files\Windows Photo Gallery 2009-12-30 14:35:05 ----D---- C:\Program Files\Common Files\System 2009-12-30 14:34:59 ----D---- C:\Windows\servicing 2009-12-30 14:34:59 ----D---- C:\Program Files\Windows Defender 2009-12-30 14:34:58 ----D---- C:\Windows\ehome 2009-12-30 14:34:37 ----D---- C:\Windows\system32\XPSViewer 2009-12-30 14:34:37 ----D---- C:\Windows\system32\sk-SK 2009-12-30 14:34:37 ----D---- C:\Windows\system32\lv-LV 2009-12-30 14:34:37 ----D---- C:\Windows\system32\hr-HR 2009-12-30 14:34:37 ----D---- C:\Windows\system32\et-EE 2009-12-30 14:34:37 ----D---- C:\Windows\system32\da-DK 2009-12-30 14:34:37 ----D---- C:\Windows\IME 2009-12-30 14:34:36 ----D---- C:\Windows\system32\ko-KR 2009-12-30 14:34:36 ----D---- C:\Windows\system32\en-US 2009-12-30 14:34:33 ----D---- C:\Windows\system32\de-DE 2009-12-30 14:34:29 ----D---- C:\Windows\system32\it-IT 2009-12-30 14:34:29 ----D---- C:\Windows\system32\el-GR 2009-12-30 14:34:28 ----D---- C:\Windows\system32\oobe 2009-12-30 14:34:28 ----D---- C:\Windows\system32\migration 2009-12-30 14:34:23 ----D---- C:\Windows\system32\AdvancedInstallers 2009-12-30 14:34:22 ----D---- C:\Windows\system32\sv-SE 2009-12-30 14:34:22 ----D---- C:\Windows\system32\SLUI 2009-12-30 14:34:22 ----D---- C:\Windows\system32\setup 2009-12-30 14:34:22 ----D---- C:\Windows\system32\ru-RU 2009-12-30 14:34:22 ----D---- C:\Windows\system32\pt-PT 2009-12-30 14:34:22 ----D---- C:\Windows\system32\hu-HU 2009-12-30 14:34:22 ----D---- C:\Windows\system32\he-IL 2009-12-30 14:34:22 ----D---- C:\Windows\system32\fr-FR 2009-12-30 14:34:22 ----D---- C:\Windows\system32\fi-FI 2009-12-30 14:34:22 ----D---- C:\Windows\system32\cs-CZ 2009-12-30 14:34:19 ----D---- C:\Windows\system32\zh-CN 2009-12-30 14:34:19 ----D---- C:\Windows\system32\sr-Latn-CS 2009-12-30 14:34:19 ----D---- C:\Windows\system32\manifeststore 2009-12-30 14:34:18 ----D---- C:\Windows\system32\zh-TW 2009-12-30 14:34:18 ----D---- C:\Windows\system32\uk-UA 2009-12-30 14:34:18 ----D---- C:\Windows\system32\sl-SI 2009-12-30 14:34:18 ----D---- C:\Windows\system32\ro-RO 2009-12-30 14:34:18 ----D---- C:\Windows\system32\pl-PL 2009-12-30 14:34:18 ----D---- C:\Windows\system32\ja-JP 2009-12-30 14:34:18 ----D---- C:\Windows\system32\es-ES 2009-12-30 14:34:18 ----D---- C:\Windows\system32\bg-BG 2009-12-30 14:34:17 ----D---- C:\Windows\system32\th-TH 2009-12-30 14:34:15 ----D---- C:\Windows\system32\tr-TR 2009-12-30 14:34:13 ----D---- C:\Windows\system32\wbem 2009-12-30 14:34:11 ----D---- C:\Windows\system32\nl-NL 2009-12-30 14:34:11 ----D---- C:\Windows\system32\nb-NO 2009-12-30 14:34:11 ----D---- C:\Windows\system32\lt-LT 2009-12-30 14:34:11 ----D---- C:\Windows\system32\ar-SA 2009-12-30 14:34:10 ----D---- C:\Windows\system32\pt-BR 2009-12-30 14:34:10 ----D---- C:\Windows\system32\migwiz 2009-12-30 14:33:14 ----RSD---- C:\Windows\Fonts 2009-12-30 14:33:14 ----D---- C:\Windows\AppPatch 2009-12-30 14:33:04 ----D---- C:\Windows\system32\Boot 2009-12-30 14:31:35 ----D---- C:\Windows\system32\RTCOM 2009-12-28 13:51:48 ----RD---- C:\Program Files 2009-12-28 13:50:25 ----D---- C:\Program Files\Common Files 2009-12-27 14:22:37 ----D---- C:\Windows\Hewlett-Packard 2009-12-26 15:36:26 ----D---- C:\Users\User\AppData\Roaming\Desktopicon 2009-12-26 00:00:26 ----D---- C:\Windows\Debug 2009-12-25 14:56:51 ----D---- C:\Program Files\DIFX 2009-12-25 14:54:34 ----HD---- C:\Program Files\InstallShield Installation Information 2009-12-25 14:14:59 ----D---- C:\Windows\system32\Tasks 2009-12-24 19:42:38 ----D---- C:\Users\User\AppData\Roaming\Skype 2009-12-24 18:11:38 ----D---- C:\Program Files\Google 2009-12-24 17:57:15 ----D---- C:\Users\User\AppData\Roaming\skypePM 2009-12-12 20:03:02 ----D---- C:\Program Files\Java 2009-12-12 17:03:02 ----D---- C:\Users\User\AppData\Roaming\gtk-2.0 2009-12-10 21:56:51 ----D---- C:\ProgramData\Microsoft Help 2009-12-01 21:06:19 ----A---- C:\Windows\system32\mrt.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104] R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2006-11-21 387432] R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232] R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2009-12-16 9968] R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2009-12-16 74480] R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2006-11-21 24184] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520] R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2006-11-21 185744] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-08 56816] R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584] R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-08-18 921600] R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-06-26 2770432] R3 BT;Bluetooth PAN Network Adapter; C:\Windows\system32\DRIVERS\btnetdrv.sys [2008-01-21 14600] R3 Dot4;MS IEEE-1284.4-Treiber; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584] R3 Dot4Print;Druckerklassentreiber für IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384] R3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864] R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2009-04-07 36608] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-06-22 1788056] R3 IvtBtBUs;IVT Bluetooth Bus Service; C:\Windows\System32\Drivers\IvtBtBus.sys [2008-07-02 26248] R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-08-24 6144] R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIV.sys [2007-05-14 135400] R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-04-30 81408] R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2009-12-16 7408] R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2007-08-24 109744] R3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328] R3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2009-05-23 29696] R3 VcommMgr;Bluetooth VComm Manager Service; C:\Windows\System32\Drivers\VcommMgr.sys [2008-07-02 29960] R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328] S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\Windows\System32\Drivers\btcusb.sys [2008-07-02 38920] S3 BthEnum;Bluetooth-Auflistungsdienst; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528] S3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160] S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2008-06-26 220160] S3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\Windows\System32\Drivers\BTHUSB.sys [2008-06-26 29184] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 202872] S3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2007-06-20 49664] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016] S3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVENG.SYS [2006-11-21 79240] S3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVEX15.SYS [2006-11-21 831880] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632] S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992] S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2006-11-21 406672] S3 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2006-11-21 245880] S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2006-11-21 275576] S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112] S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976] S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856] S3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2006-11-21 26384] S3 VComm;Virtual Serial port driver; C:\Windows\system32\DRIVERS\VComm.sys [2008-01-21 14856] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-06-21 269448] R2 AcerMemUsageCheckService;ePerformance Service; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [2007-04-16 28672] R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-09-07 185089] R2 Apache2.2;Apache2.2; C:\xampp\xampp\apache\bin\httpd.exe [2009-08-06 24640] R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-06-26 606208] R2 BsMobileCS;BsMobileCS; C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2008-08-01 143467] R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-25 457512] R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-07-03 53248] R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2009-04-07 233472] R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2008-01-19 21504] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440] R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 NMSAccessU;NMSAccessU; C:\Program Files\Common Files\NMSAccessU.exe [2007-01-25 65536] R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-07-19 262247] R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-08-14 809296] R3 BsHelpCS;BsHelpCS; C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [2008-08-01 69735] R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504] S2 gupdate1ca08906755b8aa;Google Update Service (gupdate1ca08906755b8aa); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-19 133104] S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-19 190448] S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-02-09 85096] S3 comHost;COM Host; c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2006-11-21 49296] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592] S4 BlueSoleilCS;BlueSoleilCS; C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [2008-08-04 772096] S4 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504] S4 ccEvtMgr;Symantec Event Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624] S4 ccSetMgr;Symantec Settings Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624] S4 CLTNetCnService;Symantec Lic NetConnect service; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624] S4 ISPwdSvc;Symantec IS Kennwortprüfung; c:\Program Files\Norton Internet Security\isPwdSvc.exe [2006-11-21 80552] S4 SymAppCore;Symantec AppCore Service; c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [2006-11-21 46736] -----------------EOF----------------- |
|
31.12.2009, 23:38
| #4 |
| | Rätselhafter Prozess deanapi.exe ? Und dann noch der Bericht von: http://www.trojaner-board.de/51187-a...i-malware.html
__________________ _____________________________________________ „Optimismus ist nur ein Mangel an Information.“ Heiner Müller Sicherheit?->Allgemeine Informationen Der Plural von Virus heisst "Vira"! virus(viri, n.) Substantiv O-Deklination Nom.pl/Akk.pl. |
|
05.01.2010, 16:10
| #5 |
| | Rätselhafter Prozess deanapi.exe ? Hier: Malwarebytes' Anti-Malware 1.43 Datenbank Version: 3462 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 05.01.2010 14:19:42 mbam-log-2010-01-05 (16-19-42).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 293751 Laufzeit: 1 hour(s), 45 minute(s), 23 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
05.01.2010, 16:27
| #6 |
| | Rätselhafter Prozess deanapi.exe ? eine kleine Ergänzung: der Prozess deanapi.exe ist danach nur noch 1 mal aufgetaucht, nachdem ich den Prozess beendet habe (und nichts passiert ist, ausser dass mein System nen Tick schneller lief), habe ich auch nicht merkwürdiges mehr bemerkt. Heute jedoch habe ich schon wieder rndll.exe entdeckt (im Taskmanager, als ich nach deanpi.exe schauen wollte) und der Prozess hat ja wohl was mit dem TR/Buzus.cven von vor ein paar Wochen zu tun, oder? |
|
05.01.2010, 21:26
| #7 |
| | Rätselhafter Prozess deanapi.exe ? 1. Du scheinst SUPERAntiSpyware instaliert zu haben. Was kommt den bei dem Scan mit SUPERAntiSpyware raus? 2. Schalte bitte den Teatimer von Spybot aus. 3. Die von benannten Dateien kannst du suchen und bei Virustotal auswerten lassen. Das Ergebnis kopierst du dann hier rein. 4. http://www.trojaner-board.de/74908-a...t-scanner.html 5 Lade dir bitte das neuste Antivir (free personal) runter. Gehe offline und deinstaliere Kaspersky und die Reste von Norten. Für Norten gibt es, extra, dieses Tool vom Hersteller: Download und Ausführung des Norton-Entfernungsprogramms Instaliere bitte, dein herrunter geladenes Antivir offline und update es sofort. http://www.trojaner-board.de/54192-a...tellungen.html
__________________ _____________________________________________ „Optimismus ist nur ein Mangel an Information.“ Heiner Müller Sicherheit?->Allgemeine Informationen Der Plural von Virus heisst "Vira"! virus(viri, n.) Substantiv O-Deklination Nom.pl/Akk.pl. Geändert von 4RobSen8 (05.01.2010 um 21:31 Uhr) |
|
| Themen zu Rätselhafter Prozess deanapi.exe ? |
| antivir, antwort, checken, entferne, entfernen, google, herunterladen, informationen, installationsprogramm, kaspersky, konnte, melde, merkwürdige, prozess, quarantäne, schnelle, tagen, taskma, taskmanager, testversion, troja, trojaner, version |
Hybrid-Darstellung
