| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Unbekannte Viren/Trojaner - Durchsuchung des Systems!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
17.02.2010, 18:26
| #1 |
 |  Unbekannte Viren/Trojaner - Durchsuchung des Systems! ICH BIN ZURÜCK!  mit dem Log von ComboFix, und der Nachricht, das mein System ziemlich sauber ist. ey... das verblüfft mich... Die "-.txt" habe ich von einem meiner kleinen Programme anlegen lassen, um zu testen ob das Ding auf den Ordner Zugriff hat... ist aber auch schon Ewigkeiten her.... ComboFix Log: Code:
ATTFilter ComboFix 10-02-16.03 - Admin-Konto 17.02.2010 17:13:34.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2047.1208 [GMT 1:00]
ausgeführt von:: c:\users\Paul\Desktop\CoFi.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\-.txt
.
((((((((((((((((((((((( Dateien erstellt von 2010-01-17 bis 2010-02-17 ))))))))))))))))))))))))))))))
.
2010-02-17 16:24 . 2010-02-17 16:24 -------- d-----w- c:\users\Admin-Konto\AppData\Local\temp
2010-02-17 16:24 . 2010-02-17 16:24 -------- d-----w- c:\users\Paul\AppData\Local\temp
2010-02-17 16:24 . 2010-02-17 16:24 -------- d-----w- c:\users\Mutti\AppData\Local\temp
2010-02-17 16:24 . 2010-02-17 16:24 -------- d-----w- c:\users\Gast\AppData\Local\temp
2010-02-17 16:04 . 2010-02-17 16:12 -------- d-----w- C:\CoFi
2010-02-17 14:22 . 2010-02-17 14:31 -------- d-----w- C:\Lop SD
2010-02-16 13:51 . 2010-02-16 14:56 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-15 18:18 . 2010-02-15 18:18 -------- d-----w- c:\users\Paul\AppData\Local\Microsoft_Corporation
2010-02-14 03:26 . 2007-01-01 19:03 40960 ----a-r- c:\windows\system32\psfind.dll
2010-02-13 12:14 . 2009-11-16 11:25 17224 ----a-w- c:\windows\system32\authuitu.dll
2010-02-13 12:14 . 2009-11-16 11:25 29000 ----a-w- c:\windows\system32\uxtuneup.dll
2010-02-13 12:14 . 2010-02-13 12:14 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2010-02-12 21:38 . 2010-02-13 12:14 604488 ----a-w- c:\windows\system32\TUProgSt.exe
2010-02-12 21:26 . 2010-02-12 21:26 331776 ----a-w- c:\programdata\TuneUp Software\TuneUp Utilities\WinStyler\LogoAnimations\forcefield.tla.dll
2010-02-12 21:24 . 2009-08-30 15:32 2424832 ----a-w- c:\users\Paul\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler\LogonScreens\LoginIsland.tls.dll
2010-02-12 21:24 . 2009-05-25 17:42 1990656 ----a-w- c:\users\Paul\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler\LogonScreens\StarryNight.tls.dll
2010-02-12 21:24 . 2009-11-08 00:58 3383296 ----a-w- c:\users\Paul\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler\LogonScreens\Borabora.tls.dll
2010-02-10 20:35 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-02-10 20:35 . 2009-03-30 08:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-02-10 20:35 . 2010-02-10 20:35 -------- d-----w- c:\programdata\Avira
2010-02-10 20:35 . 2010-02-10 20:35 -------- d-----w- c:\program files\Avira
2010-02-10 15:11 . 2009-12-11 11:43 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-02-10 15:11 . 2009-12-11 11:43 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-02-09 18:16 . 2010-02-09 18:16 -------- d-----w- c:\program files\Common Files\Java
2010-02-09 16:19 . 2010-02-09 16:19 -------- d-----w- c:\users\Admin-Konto\AppData\Roaming\Malwarebytes
2010-02-09 16:14 . 2010-02-09 16:14 -------- d-----w- c:\users\Admin-Konto\AppData\Local\RapidSolution
2010-02-09 13:07 . 2010-02-09 13:07 -------- d-----w- c:\users\Paul\AppData\Roaming\Malwarebytes
2010-02-09 13:07 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 13:07 . 2010-02-09 13:07 -------- d-----w- c:\programdata\Malwarebytes
2010-02-09 13:07 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-09 02:01 . 2010-02-09 02:02 88 ----a-w- c:\users\Mutti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Autostart.bat
2010-02-08 22:36 . 2010-02-10 13:14 -------- d-----w- c:\programdata\SecTaskMan
2010-02-08 22:36 . 2010-02-08 22:36 -------- d-----w- c:\program files\Security Task Manager
2010-02-07 20:29 . 2010-02-07 20:29 -------- d-----w- c:\users\Paul\AppData\Roaming\Uniblue
2010-02-07 18:09 . 2010-02-07 18:14 -------- d-----w- c:\program files\NVIDIA Corporation
2010-02-05 15:07 . 2010-02-05 15:07 -------- d-----w- c:\users\Paul\AppData\Roaming\Earth 2140
2010-02-04 12:40 . 2010-02-04 12:40 34648 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\x64\wmi64.exe
2010-02-04 12:40 . 2010-02-04 12:40 208616 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\avp.exe
2010-02-04 12:40 . 2010-02-04 12:40 176656 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\x64\scrchpg.dll
2010-02-04 12:40 . 2010-02-04 12:40 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\wmifw.exe
2010-02-04 12:40 . 2010-02-04 12:40 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\wmiav.exe
2010-02-04 12:40 . 2010-02-04 12:40 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\wmias.exe
2010-02-04 12:40 . 2010-02-04 12:40 176656 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\x64\scrchpg.dll
2010-02-04 12:40 . 2010-02-04 12:40 34648 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\x64\wmi64.exe
2010-02-04 12:40 . 2010-02-04 12:40 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\wmifw.exe
2010-02-04 12:40 . 2010-02-04 12:40 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\wmiav.exe
2010-02-04 12:40 . 2010-02-04 12:40 12888 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\wmias.exe
2010-02-04 12:40 . 2010-02-04 12:40 208616 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\avp.exe
2010-02-02 17:08 . 2010-02-02 17:15 -------- d-----w- c:\program files\VDMSound
2010-01-31 23:19 . 2010-01-31 23:19 -------- d-----w- c:\users\Paul\AppData\Local\DOSBox
2010-01-31 23:19 . 2010-02-03 12:38 -------- d-----w- c:\program files\DOSBox-0.73
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-17 16:08 . 2009-05-23 17:37 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-17 16:04 . 2009-08-22 10:15 2646048 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-17 16:04 . 2009-08-22 10:15 13268 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-17 16:04 . 2009-05-23 17:37 5403032 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-17 16:04 . 2009-05-23 17:37 398298912 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-17 11:33 . 2006-11-02 15:33 711288 ----a-w- c:\windows\system32\perfh007.dat
2010-02-17 11:33 . 2006-11-02 15:33 154246 ----a-w- c:\windows\system32\perfc007.dat
2010-02-17 11:20 . 2009-11-11 11:52 52592 ----a-w- c:\programdata\nvModes.dat
2010-02-17 00:51 . 2009-04-14 15:09 -------- d-----w- c:\program files\Verschiedene Programme und Tools
2010-02-17 00:49 . 2009-04-13 21:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-15 18:41 . 2009-08-30 19:19 -------- d-----w- c:\program files\Microsoft SQL Server
2010-02-15 18:41 . 2009-04-13 22:20 -------- d-----w- c:\program files\Microsoft.NET
2010-02-15 01:39 . 2009-05-11 13:35 -------- d-----w- c:\program files\Common Files\Microsoft Games
2010-02-13 13:01 . 2009-07-31 17:41 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-13 12:54 . 2009-11-08 00:58 3465216 ----a-w- c:\programdata\TuneUp Software\TuneUp Utilities\WinStyler\LogonScreens\Borabora.tls.dll
2010-02-12 19:18 . 2009-07-24 17:44 -------- d-----w- c:\users\Paul\AppData\Roaming\Skype
2010-02-12 16:19 . 2009-07-24 18:02 -------- d-----w- c:\users\Paul\AppData\Roaming\skypePM
2010-02-12 16:10 . 2009-04-14 15:36 -------- d-----w- c:\users\Paul\AppData\Roaming\gtk-2.0
2010-02-12 00:17 . 2009-10-25 12:41 103184 ----a-w- c:\users\Admin-Konto\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-11 17:54 . 2009-04-13 21:38 -------- d-----w- c:\users\Paul\AppData\Roaming\ICQ
2010-02-11 17:28 . 2009-04-15 15:53 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-10 15:50 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-10 14:52 . 2009-10-10 23:55 -------- d-----w- c:\users\Paul\AppData\Roaming\Winamp
2010-02-09 17:57 . 2009-10-03 16:33 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-08 10:10 . 2009-04-28 10:34 -------- d-----w- c:\users\Mutti\AppData\Roaming\Winamp
2010-02-07 19:23 . 2009-04-13 14:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-02-07 18:14 . 2009-04-13 14:59 -------- d-----w- c:\programdata\NVIDIA
2010-02-05 11:37 . 2009-04-15 18:08 -------- d-----w- c:\program files\Winamp
2010-02-04 18:26 . 2009-07-21 17:53 -------- d-----w- c:\program files\Google
2010-02-04 12:40 . 2009-11-18 10:26 59920 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\mzvkbd.dll
2010-02-04 12:40 . 2009-11-18 10:26 109072 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Update distribution\AutoPatches\cbild\8.0.0.506\mzvkbd3.dll
2010-02-04 12:40 . 2009-08-26 13:41 109072 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\mzvkbd3.dll
2010-02-04 12:40 . 2009-08-26 13:41 59920 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\cbild\8.0.0.506\mzvkbd.dll
2010-02-01 23:55 . 2009-10-16 19:40 -------- d-----w- c:\users\Paul\AppData\Roaming\BitTorrent
2010-01-28 19:26 . 2009-09-03 14:39 -------- d-----w- c:\program files\ICQ6.5
2010-01-22 18:01 . 2009-08-03 12:17 138384 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-22 18:01 . 2009-08-03 12:11 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-01-21 12:54 . 2009-04-13 20:22 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-15 21:31 . 2010-01-10 01:17 -------- d-----w- c:\users\Paul\AppData\Roaming\Meine Der Herr der Ringe™, Aufstieg des Hexenkönigs™-Dateien
2010-01-15 20:54 . 2009-07-31 18:20 77824 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\tk_EXT2.dll
2010-01-15 20:54 . 2009-07-31 18:20 109080 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\sp_audio.dll
2010-01-15 20:54 . 2009-07-31 18:20 570368 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\guisys2.dll
2010-01-15 20:54 . 2009-07-31 18:20 1265664 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\guifx.dll
2010-01-15 20:54 . 2010-01-15 20:54 251392 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\Forests.dll
2010-01-15 20:54 . 2009-07-31 18:20 444952 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\driv_xal.dll
2010-01-15 20:54 . 2009-07-22 19:54 98304 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\audioengine2_1.dll
2010-01-15 20:54 . 2009-07-22 19:54 358400 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\SceneMax.dll
2010-01-15 20:54 . 2009-07-22 19:54 307200 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\gamedata\audioengine1.dll
2010-01-15 20:52 . 2009-07-28 11:32 442 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\updates\update.bat
2010-01-15 20:52 . 2009-07-22 10:32 468436 ----a-w- c:\users\Paul\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\Launcher.exe
2010-01-15 17:47 . 2010-01-15 13:35 -------- d-----w- c:\program files\GameSpy Arcade
2010-01-14 10:12 . 2009-10-03 11:45 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-11 21:18 . 2010-01-11 21:18 962664 ----a-w- c:\windows\system32\nvsvc.dll
2010-01-11 21:18 . 2010-01-11 21:18 13679720 ----a-w- c:\windows\system32\nvcpl.dll
2010-01-11 21:18 . 2010-01-11 21:18 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-01-11 21:18 . 2010-01-11 21:18 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-01-10 21:40 . 2009-04-15 12:22 103184 ----a-w- c:\users\Mutti\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-10 19:56 . 2009-04-13 14:44 103184 ----a-w- c:\users\Paul\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-10 18:38 . 2009-04-29 16:45 1111 ----a-w- c:\windows\eReg.dat
2010-01-04 18:02 . 2009-04-14 21:08 -------- d-----w- c:\program files\DivX
2010-01-04 16:55 . 2010-01-04 16:55 62760 ----a-w- c:\users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\epo7edu3.NewProfil1\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
2010-01-03 12:31 . 2009-04-13 17:46 -------- d-----w- c:\program files\Veoh Networks
2010-01-02 06:38 . 2010-01-22 10:14 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 10:14 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 10:14 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 10:14 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-01-01 08:29 . 2010-01-01 08:30 737280 ----a-w- c:\windows\iun6002.exe
2009-12-31 16:04 . 2009-12-31 16:04 -------- d-----w- c:\program files\AC3Filter
2009-12-26 13:42 . 2010-01-03 12:27 110592 ----a-w- c:\users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\jbxx60mr.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
2009-12-24 21:37 . 2009-09-27 08:24 -------- d-----w- c:\users\Paul\AppData\Roaming\FreeFLVConverter
2009-12-22 16:48 . 2009-11-06 14:24 324472 ----a-w- c:\programdata\RapidSolution\GUIcommon.dll
2009-12-21 12:58 . 2009-04-20 17:52 -------- d-----w- c:\users\Paul\AppData\Roaming\dvdcss
2009-12-18 15:36 . 2009-12-18 15:36 4734424 ----a-w- c:\users\Mutti\AppData\Roaming\ProtectDisc\pe17da5d19.dll
2009-12-17 20:13 . 2009-12-17 20:13 476512 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\RadioRip.dll
2009-12-17 20:13 . 2009-12-17 20:13 169312 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgSoundclick.dll
2009-12-17 20:13 . 2009-12-17 20:13 111968 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgPandora.dll
2009-12-17 20:13 . 2009-12-17 20:13 128352 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgMyspace.dll
2009-12-17 20:13 . 2009-12-17 20:13 111968 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgLastfm.dll
2009-12-17 20:13 . 2009-12-17 20:13 99680 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgIJigg.dll
2009-12-17 20:13 . 2009-12-17 20:13 230752 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgHypemachine.dll
2009-12-17 20:13 . 2009-12-17 20:13 120160 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgGeneral.dll
2009-12-17 20:13 . 2009-12-17 20:13 87392 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgDefault.dll
2009-12-17 20:13 . 2009-12-17 20:13 140640 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\RadioRip\PlgDeezer.dll
2009-12-17 20:13 . 2009-12-17 20:13 495616 ----a-w- c:\programdata\RapidSolution\AudialsOne_2009\EncodingBackend\lame_enc.dll
2009-12-08 20:01 . 2010-02-10 15:10 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 20:01 . 2010-02-10 15:10 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:01 . 2010-02-10 15:10 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:26 . 2010-02-10 15:10 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-12-06 16:57 . 2009-06-30 13:13 94074 ----a-w- c:\windows\unins000.dat
2009-12-06 16:41 . 2009-06-30 13:13 681980 ----a-w- c:\windows\unins000.exe
2009-12-04 18:30 . 2010-02-10 15:10 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-04 18:29 . 2010-02-10 15:10 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-12-04 18:28 . 2010-02-10 15:10 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-04 18:28 . 2010-02-10 15:10 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-04 18:28 . 2010-02-10 15:10 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-04 18:28 . 2010-02-10 15:10 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-04 18:28 . 2010-02-10 15:10 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-04 18:28 . 2010-02-10 15:10 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-04 18:27 . 2010-02-10 15:10 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-12-04 15:56 . 2010-02-10 15:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2007-04-17 08:30 . 2007-04-17 08:30 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
------- Sigcheck -------
[-] 2009-10-31 . 690D53BD10A804BB6D0A772D1C0E6907 . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"Real Desktop"="c:\program files\Verschiedene Programme und Tools\Real Desktop\Real Desktop.exe" [2009-08-13 7405568]
"DAEMON Tools Lite"="c:\program files\Verschiedene Programme und Tools\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Verschiedene Programme und Tools\Kaspersky Security CBE 09\avp.exe" [2010-02-04 208616]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Winamp.lnk - c:\program files\Winamp\winamp.exe [2010-1-13 1552736]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\VERSCH~1\KASPER~2\mzvkbd3.dll c:\progra~1\VERSCH~1\KASPER~2\adialhk.dll c:\progra~1\VERSCH~1\KASPER~2\kloehk.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Verschiedene Programme und Tools\Adobe Acrobat Reader\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):41,1c,0d,2e,72,55,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4252891048-179042973-2712302023-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
R0 fsbts;fsbts;c:\windows\System32\drivers\fsbts.sys [25.09.2009 13:11 26624]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29.01.2008 17:29 32784]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09.07.2008 17:28 20496]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [10.02.2010 21:35 108289]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Verschiedene Programme und Tools\Spybot - Search & Destroy\SDWinSec.exe [16.02.2010 14:51 1153368]
R3 Atc002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\System32\drivers\l260x86.sys [16.10.2008 14:17 29184]
R3 GMFilter Filter;GMFilter Filter;c:\windows\System32\drivers\GMFilter.sys [14.04.2009 00:09 27648]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13.03.2008 18:02 26640]
R3 RRNetCapMP;RRNetCapMP;c:\windows\System32\drivers\rrnetcap.sys [16.11.2009 14:45 27168]
R3 TUSB1150;devolo WLAN USB Stick;c:\windows\System32\drivers\TUSB1150.sys [13.04.2009 15:50 494848]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [13.06.2009 22:04 721904]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [03.10.2009 21:58 54632]
S3 fsssvc;Windows Live Family Safety-Dienst;c:\program files\Windows Live\Family Safety\fsssvc.exe [05.08.2009 21:48 704864]
S3 gupdate1ca0a2c2f5dc998;Google Update Service (gupdate1ca0a2c2f5dc998);c:\program files\Google\Update\GoogleUpdate.exe [21.07.2009 18:53 133104]
S3 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero Brennprogramm\Nero 7\InCD\NBHRegInCDSrv.exe --> c:\program files\Nero Brennprogramm\Nero 7\InCD\NBHRegInCDSrv.exe [?]
S3 RRNetCap;RRNetCap Service;c:\windows\System32\drivers\rrnetcap.sys [16.11.2009 14:45 27168]
S4 DBService;DATA BECKER Update Service;c:\program files\Common Files\DATA BECKER Shared\DBService.exe --> c:\program files\Common Files\DATA BECKER Shared\DBService.exe [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
rsmsvcs REG_MULTI_SZ ntmssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
2010-02-17 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\Verschiedene Programme und Tools\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 12:00]
2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 17:53]
2010-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 17:53]
2010-02-17 c:\windows\Tasks\User_Feed_Synchronization-{30318B9E-EEBB-4835-A686-E843BE2B3C55}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = about:blank
IE: Hinzufügen zu Anti-Banner - c:\program files\Verschiedene Programme und Tools\Kaspersky Security CBE 09\ie_banner_deny.htm
IE: Mit &Google suchen - c:\programdata\TuneUp Software\TuneUp Utilities\Web\gsearch.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Seite mit Google übersetzen - c:\programdata\TuneUp Software\TuneUp Utilities\Web\gtranslate.htm
IE: Zoom &In* - c:\programdata\TuneUp Software\TuneUp Utilities\Web\tuzoomin.htm
IE: Zoom &Out* - c:\programdata\TuneUp Software\TuneUp Utilities\Web\tuzoomout.htm
IE: Übersetzen mit &dict.leo.org - c:\programdata\TuneUp Software\TuneUp Utilities\Web\tutrans.htm
LSP: c:\windows\system32\wpclsp.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
AddRemove-Age of Empires - c:\spiele\Age of Empires (I
AddRemove-Age of Empires 2.0 - c:\spiele\Age of Empires (I
AddRemove-Age of Empires Expansion 1.0 - c:\spiele\Age of Empires (I
AddRemove-Age of Empires II: The Conquerors Expansion 1.0 - c:\spiele\Age of Empires (I
AddRemove-Pirate Galaxy - c:\users\Admin-Konto\AppData\Roaming\Splitscreen Studios\Pirate Galaxy\uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 17:24
Windows 6.0.6002 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-4252891048-179042973-2712302023-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:81,34,4a,2d,de,22,ab,33,53,ba,41,d2,16,2d,56,75,be,eb,81,54,4a,5a,ee,
5c,1b,7f,78,55,ad,a0,0c,0e,38,df,51,fc,6a,b1,fa,21,10,fd,98,87,c8,0c,1f,de,\
"??"=hex:32,6d,17,bd,ce,bc,fe,c7,b0,58,a8,8f,4a,f8,bf,a3
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-02-17 17:28:27
ComboFix-quarantined-files.txt 2010-02-17 16:28
Vor Suchlauf: 18 Verzeichnis(se), 66.869.690.368 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 76.052.004.864 Bytes frei
- - End Of File - - 1A5EF5BB81D47443E94A2CADD1320179
Ich bedanke mich für deine Unterstützung und, soweit es nichts zu beklagen gibt, verabschiede mich. Das Thema lass ich aboniert.  <--- Den Smylie mag ich.Danke und MfG Perahoky. EDIT: Ich habe irgendwo mal gelesen, das Windows haufenweise Möglichkeiten bietet, ein Programm unbemerkt bei Systemstart mit starten zu lasen. Was gibt es den da für Möglichkeiten, auser "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-", "C:\Users\*Alle User*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" ? Wo werden z.b. die Dienste festgelegt? (und jetzt nicht "services.msc"!) Ich hatte mal ein Programm, da hab ich markiert es solle sich mit Windowsstart starten, aber ich habe an keinem der Orte eine Veränderung feststellen können. Den Programmnamen weiß ich nicht mehr. mfg Pera Geändert von Perahoky (17.02.2010 um 18:35 Uhr) |
|
| Themen zu Unbekannte Viren/Trojaner - Durchsuchung des Systems! |
| 0 bytes, 1.tmp, antivir, antivir guard, antivirus, antivirus scan, applaus, audiodg.exe, avira, bho, browser, c:\windows\temp, computer, erste mal, excel, festplatte, google, gservice, hijack, hijack.displayproperties, hijackthis, hkus\s-1-5-18, internet, kaspersky, malware, malware.trace, nt.dll, online virus, plug-in, programdata, realtek, registrierungsschlüssel, registry, rundll, safer networking, scan, schutz, seaport.exe, security, security suite, services.exe, software, spielstände, starten, suchlauf, svchost.exe, taskmgr.exe, tr/crypt.xpack.ge, trojaner, trojaner-board, versteckte objekte, verweise, viren, virus gefunden, vista, warnung, windows\temp |
Hybrid-Darstellung
