| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Agent.ruo gefunden.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
05.04.2010, 18:43
| #1 |
 |  TR/Agent.ruo gefunden. Hallo miteinander. Habe wie so viele folgende Meldung über Avira bekommen: In der Datei 'D:\System Volume Information\_restore{2A9E56D2-8729-46BD-B6C5-9776441E5EBD}\RP573\A0066679.sys' wurde ein Virus oder unerwünschtes Programm 'TR/Agent.ruo' [trojan] gefunden. Jetzt wollte ich euren Beschreibungen folgen, aber wenn ich dieses Osam herunterlade bekomme ich nur eine Word Datei Kann mir jemand weiterhelfen. Danke Gruß Everell1 |
|
05.04.2010, 19:13
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | TR/Agent.ruo gefunden. Hallo und
__________________ Benutzt Du diesen Link => http://www2.online-solutions.ru/en/d...e.php?p=131115 Da sollte eine RAR-Datei erscheinen.
__________________ |
|
05.04.2010, 19:37
| #3 |
| | TR/Agent.ruo gefunden. Hier mal ein Bericht:
__________________Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Datenbank Version: 3957 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 05.04.2010 20:35:33 mbam-log-2010-04-05 (20-35-33).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 156119 Laufzeit: 17 Minute(n), 52 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 1 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\D:\WINDOWS\system32\SysRestore.dll (Rogue.Ascentive) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: D:\Dokumente und Einstellungen\All Users\AVP 2009 (Malware.Trace) -> Quarantined and deleted successfully. Infizierte Dateien: D:\WINDOWS\system32\SysRestore.dll (Rogue.Ascentive) -> Quarantined and deleted successfully. Was muss ich weiter tun? Danke und Gruß Everell1 |
|
05.04.2010, 19:39
| #4 | |
| | TR/Agent.ruo gefunden.Zitat:
Nur was mache ich damit? Gruß Everell1 |
|
05.04.2010, 19:53
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Agent.ruo gefunden. RAR ist keine Worddatei, auch keine Art Worddatei  Das ist ein Archivformat ähnlich wie ZIP. Du brauchst ein Entpacktool, das RAR beherrscht, um das entpacken zu können, 7zip und WinRAR können das.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
05.04.2010, 19:56
| #6 |
| | TR/Agent.ruo gefunden. nächster Bericht Logfile of random's system information tool 1.06 (written by random/random) Run by xxxxxx at 2010-04-05 20:49:44 Microsoft Windows XP Professional Service Pack 3 System drive D: has 5 GB (14%) free of 38 GB Total RAM: 511 MB (45% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:49:45, on 05.04.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\brss01a.exe D:\WINDOWS\system32\spoolsv.exe D:\Programme\Avira\AntiVir Desktop\sched.exe D:\Programme\ScanSoft\PaperPort\pptd40nt.exe D:\Programme\ATI Technologies\ATI.ACE\cli.exe D:\WINDOWS\RTHDCPL.EXE D:\Programme\Avira\AntiVir Desktop\avgnt.exe D:\Programme\Java\jre6\bin\jusched.exe D:\Programme\Canon\MyPrinter\BJMyPrt.exe D:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe D:\WINDOWS\system32\ctfmon.exe D:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe D:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe D:\Programme\FRITZ!DSL\StCenter.exe D:\Programme\FRITZ!DSL\FwebProt.exe D:\Programme\Avira\AntiVir Desktop\avguard.exe D:\Programme\FRITZ!DSL\IGDCTRL.EXE D:\Programme\Java\jre6\bin\jqs.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\TUProgSt.exe D:\Programme\PC Connectivity Solution\ServiceLayer.exe D:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe D:\Programme\PC Connectivity Solution\Transports\NclIrSrv.exe D:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe D:\Programme\ATI Technologies\ATI.ACE\cli.exe D:\Programme\ATI Technologies\ATI.ACE\cli.exe D:\Dokumente und Einstellungen\xxxxxx\Desktop\RSIT(3).exe D:\Programme\trend micro\xxxxxx.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = fritz.box O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [PaperPort PTD] D:\Programme\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] D:\Programme\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [ATICCC] "D:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [avgnt] "D:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [CanonSolutionMenu] D:\Programme\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] D:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [WrtMon.exe] D:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "D:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "D:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "D:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PC Suite Tray] "D:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: FRITZ!DSL Protect.lnk = D:\Programme\FRITZ!DSL\FwebProt.exe O4 - Global Startup: FRITZ!DSL Startcenter.lnk = D:\Programme\FRITZ!DSL\StCenter.exe O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {AEF9B8DB-0DEF-4c0b-8209-661C9E82B8C3} - D:\Programme\WinSysClean 2008\UDManager\UDManager.exe (file missing) O9 - Extra 'Tools' menuitem: Ultimate Download Manager - {AEF9B8DB-0DEF-4c0b-8209-661C9E82B8C3} - D:\Programme\WinSysClean 2008\UDManager\UDManager.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVM IGD CTRL Service - AVM Berlin - D:\Programme\FRITZ!DSL\IGDCTRL.EXE O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - D:\WINDOWS\system32\brsvc01a.exe O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - D:\Programme\Gemeinsame Dateien\AVM\de_serv.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - D:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - D:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Programme\Java\jre6\bin\jqs.exe O23 - Service: ServiceLayer - Nokia - D:\Programme\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - D:\WINDOWS\System32\TUProgSt.exe -- End of file - 7415 bytes ======Scheduled tasks folder====== D:\WINDOWS\tasks\Google Software Updater.job D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - D:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - D:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-22 668656] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - D:\Programme\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - D:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "PaperPort PTD"=D:\Programme\ScanSoft\PaperPort\pptd40nt.exe [2004-03-09 57393] "IndexSearch"=D:\Programme\ScanSoft\PaperPort\IndexSearch.exe [2004-03-09 40960] "ATICCC"=D:\Programme\ATI Technologies\ATI.ACE\cli.exe [2005-08-12 45056] "RTHDCPL"=D:\WINDOWS\RTHDCPL.EXE [2006-04-04 16120832] "Alcmtr"=D:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "NeroCheck"=D:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] "avgnt"=D:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "KernelFaultCheck"=D:\WINDOWS\system32\dumprep 0 -k [] "SunJavaUpdateSched"=D:\Programme\Java\jre6\bin\jusched.exe [2009-07-25 149280] "CanonSolutionMenu"=D:\Programme\Canon\SolutionMenu\CNSLMAIN.exe [2007-05-14 644696] "CanonMyPrinter"=D:\Programme\Canon\MyPrinter\BJMyPrt.exe [2007-04-03 1603152] "WrtMon.exe"=D:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe [2006-09-20 20480] "Adobe Reader Speed Launcher"=D:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760] "Adobe ARM"=D:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672] "SSBkgdUpdate"=D:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472] " Malwarebytes Anti-Malware (reboot)"=D:\Programme\Malwarebytes' Anti-Malware\mbam.exe [2010-03-29 1086856] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2010-03-29 437584] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "PC Suite Tray"=D:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-11-11 1451520] D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart FRITZ!DSL Startcenter.lnk - D:\Programme\FRITZ!DSL\StCenter.exe Microsoft Office.lnk - D:\Programme\Microsoft Office\Office10\OSA.EXE D:\Dokumente und Einstellungen\Rischke\Startmenü\Programme\Autostart FRITZ!DSL Protect.lnk - D:\Programme\FRITZ!DSL\FwebProt.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] D:\WINDOWS\system32\Ati2evxx.dll [2006-02-21 61440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] D:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\WINDOWS\system32\usmt\migwiz.exe"="D:\WINDOWS\system32\usmt\migwiz.exe:* isabled:Assistent zum Übertragen von Dateien und Einstellungen""D:\Programme\FRITZ!DSL\IGDCTRL.EXE"="D:\Programme\FRITZ!DSL\IGDCTRL.EXE:*:Enabled:FRITZ!DSL - igdctrl.exe" "D:\Programme\FRITZ!DSL\FBOXUPD.EXE"="D:\Programme\FRITZ!DSL\FBOXUPD.EXE:*:Enabled:AVM FRITZ!Box Firmware-Update" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "F:\fsetup.exe"="F:\fsetup.exe:*:Enabled:AVM FSetup Application" "D:\Programme\Mozilla Firefox\firefox.exe"="D:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======List of files/folders created in the last 1 months====== 2010-04-05 20:43:38 ----D---- D:\Programme\trend micro 2010-04-05 20:43:35 ----D---- D:\rsit 2010-04-05 20:15:17 ----D---- D:\Dokumente und Einstellungen\Rischke\Anwendungsdaten\Malwarebytes 2010-04-05 20:14:51 ----D---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2010-04-05 20:14:50 ----D---- D:\Programme\Malwarebytes' Anti-Malware 2010-04-05 20:00:56 ----D---- D:\Programme\CCleaner 2010-03-29 01:03:36 ----SHD---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC} 2010-03-28 22:58:04 ----D---- D:\Dokumente und Einstellungen\Rischke\Anwendungsdaten\widestream 2010-03-28 22:56:47 ----D---- D:\Dokumente und Einstellungen\Rischke\Anwendungsdaten\OfferBox 2010-03-28 22:56:46 ----D---- D:\Programme\OfferBox 2010-03-28 20:45:30 ----HDC---- D:\WINDOWS\$NtUninstallKB952011$ 2010-03-28 20:41:11 ----N---- D:\WINDOWS\system32\vxblock.dll 2010-03-28 20:41:11 ----N---- D:\WINDOWS\system32\pxwave.dll 2010-03-28 20:41:11 ----N---- D:\WINDOWS\system32\pxmas.dll 2010-03-28 20:41:11 ----N---- D:\WINDOWS\system32\pxhpinst.exe 2010-03-28 20:41:11 ----N---- D:\WINDOWS\system32\pxdrv.dll 2010-03-28 20:41:11 ----N---- D:\WINDOWS\system32\px.dll 2010-03-26 21:57:10 ----HDC---- D:\WINDOWS\$NtUninstallWudf01007$ 2010-03-26 21:56:12 ----N---- D:\WINDOWS\system32\spmsgXP_2k3.dll 2010-03-26 21:56:05 ----HDC---- D:\WINDOWS\$NtUninstallWdf01007$ 2010-03-26 20:05:40 ----N---- D:\WINDOWS\system32\browserchoice.exe 2010-03-20 11:02:33 ----D---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite 2010-03-20 02:14:40 ----D---- D:\Programme\Gemeinsame Dateien\PCSuite 2010-03-20 02:12:37 ----D---- D:\Programme\Gemeinsame Dateien\Nokia 2010-03-20 02:10:58 ----D---- D:\Programme\DIFX 2010-03-20 02:10:23 ----D---- D:\Programme\PC Connectivity Solution 2010-03-20 02:09:56 ----A---- D:\WINDOWS\system32\wdfcoinstaller01007.dll 2010-03-20 02:09:56 ----A---- D:\WINDOWS\system32\nmwcdcocls.dll 2010-03-20 02:09:46 ----D---- D:\Programme\Nokia 2010-03-20 02:05:14 ----D---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations 2010-03-19 12:47:29 ----D---- D:\Dokumente und Einstellungen\xxxxxx\Anwendungsdaten\Nokia Multimedia Player 2010-03-19 12:46:38 ----D---- D:\Dokumente und Einstellungen\xxxxxx\Anwendungsdaten\DataLayer 2010-03-19 12:46:08 ----D---- D:\Dokumente und Einstellungen\xxxxxx\Anwendungsdaten\Nokia 2010-03-19 12:44:02 ----D---- D:\Dokumente und Einstellungen\xxxxxx\Anwendungsdaten\PC Suite 2010-03-19 12:42:32 ----D---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations 2010-03-10 16:09:23 ----HDC---- D:\WINDOWS\$NtUninstallKB975561$ 2010-03-10 12:18:42 ----HDC---- D:\WINDOWS\$NtUninstallKB977165-v2$ 2010-03-08 18:03:01 ----D---- D:\Programme\MSECache ======List of files/folders modified in the last 1 months====== 2010-04-05 20:47:11 ----D---- D:\Programme\Mozilla Firefox 2010-04-05 20:43:42 ----D---- D:\Dokumente und Einstellungen\Rischke\Anwendungsdaten\FRITZ! 2010-04-05 20:43:38 ----RD---- D:\Programme 2010-04-05 20:38:28 ----D---- D:\WINDOWS\system32\drivers 2010-04-05 20:38:28 ----D---- D:\WINDOWS\Downloaded Installations 2010-04-05 20:35:32 ----D---- D:\WINDOWS\system32 2010-04-05 20:14:43 ----D---- D:\WINDOWS\Prefetch 2010-04-05 20:05:33 ----D---- D:\WINDOWS\MiniDump 2010-04-05 20:05:33 ----D---- D:\WINDOWS\Debug 2010-04-05 20:05:33 ----D---- D:\WINDOWS 2010-04-05 20:05:32 ----D---- D:\WINDOWS\Temp 2010-04-05 14:01:21 ----SD---- D:\WINDOWS\Tasks 2010-04-05 14:01:13 ----D---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater 2010-04-05 11:24:07 ----D---- D:\WINDOWS\system32\CatRoot2 2010-04-05 02:44:43 ----N---- D:\WINDOWS\SchedLgU.Txt 2010-03-31 10:16:32 ----HD---- D:\WINDOWS\inf 2010-03-31 10:15:47 ----RSHDC---- D:\WINDOWS\system32\dllcache 2010-03-31 10:15:44 ----D---- D:\Programme\Internet Explorer 2010-03-31 10:15:26 ----D---- D:\WINDOWS\ie8updates 2010-03-31 10:13:55 ----HD---- D:\WINDOWS\$hf_mig$ 2010-03-29 07:29:19 ----D---- D:\Config.Msi 2010-03-29 01:31:52 ----SHD---- D:\WINDOWS\Installer 2010-03-29 01:31:52 ----D---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software 2010-03-29 00:58:07 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI 2010-03-26 21:57:46 ----SD---- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft 2010-03-26 21:57:24 ----D---- D:\WINDOWS\system32\LogFiles 2010-03-21 19:35:55 ----A---- D:\WINDOWS\videodeLuxe.INI 2010-03-20 02:14:40 ----D---- D:\Programme\Gemeinsame Dateien 2010-03-20 02:11:21 ----D---- D:\WINDOWS\system32\CatRoot 2010-03-20 02:10:52 ----DC---- D:\WINDOWS\system32\DRVSTORE 2010-03-20 02:09:30 ----D---- D:\WINDOWS\WinSxS 2010-03-10 16:09:25 ----D---- D:\Programme\Movie Maker 2010-03-08 18:11:21 ----SD---- D:\Dokumente und Einstellungen\xxxxxx\Anwendungsdaten\Microsoft 2010-03-08 18:04:46 ----D---- D:\Programme\Gemeinsame Dateien\Microsoft Shared 2010-03-08 18:04:37 ----RSD---- D:\WINDOWS\Fonts 2010-03-08 18:04:24 ----D---- D:\Programme\Microsoft Office ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;AMD Processor Driver; D:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352] R1 avgio;avgio; \??\D:\Programme\Avira\AntiVir Desktop\avgio.sys [] R1 avipbb;avipbb; D:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-04-27 96104] R1 ElbyCDIO;ElbyCDIO Driver; D:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-09-26 25768] R1 ssmdrv;ssmdrv; D:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-09 28520] R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; D:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032] R2 avgntflt;avgntflt; D:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-07 56816] R2 irda;IrDA-Protokoll; D:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192] R3 AnyDVD;AnyDVD; D:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-12-08 104512] R3 ati2mtag;ati2mtag; D:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-02-21 1505792] R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-06 4258816] R3 irsir;Microsoft serieller Infrarottreiber; D:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; D:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-22 52736] R3 nvnetbus;NVIDIA Network Bus Enumerator; D:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-22 18944] R3 Rasirda;WAN-Miniport (IrDA); D:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 usbccgp;Microsoft Standard-USB-Haupttreiber; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Microsoft USB-Standardhubtreiber; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; D:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] R3 usbprint;Microsoft USB-Druckerklasse; D:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] R3 usbscan;USB-Scannertreiber; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] R3 USBSTOR;USB-Massenspeichertreiber; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S1 d3dstdy;d3dstdy; \??\D:\WINDOWS\system32\drivers\d3dstdy.sys [] S3 AVMUNET;AVM FRITZ!Box; D:\WINDOWS\system32\DRIVERS\avmunet.sys [2005-02-22 15104] S3 BrScnUsb;Brother USB Still Image driver; D:\WINDOWS\System32\Drivers\BrScnUsb.sys [2003-12-19 15263] S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver; D:\WINDOWS\System32\Drivers\BrSerIf.sys [2004-06-12 51712] S3 BrUsbSer;Brother MFC USB Serial WDM Driver; D:\WINDOWS\System32\Drivers\BrUsbSer.sys [2004-01-10 11648] S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS [] S3 nmwcd;Nokia USB Phone Parent; D:\WINDOWS\system32\drivers\ccdcmb.sys [2009-10-06 17664] S3 nmwcdc;Nokia USB Generic; D:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-10-06 22016] S3 NTACCESS;NTACCESS; \??\F:\NTACCESS.sys [] S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\D:\WINDOWS\system32\PCAMPR5.SYS [] S3 pccsmcfd;PCCS Mode Change Filter Driver; D:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816] S3 PLCMPR5;PLCMPR5 NDIS Protocol Driver; \??\D:\WINDOWS\system32\PLCMPR5.SYS [] S3 TVICHW32;TVICHW32; \??\D:\WINDOWS\system32\DRIVERS\TVICHW32.SYS [] S3 Wdf01000;Kernel Mode Driver Frameworks service; D:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-01-18 83328] S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirSchedulerService;Avira AntiVir Planer; D:\Programme\Avira\AntiVir Desktop\sched.exe [2009-06-09 108289] R2 AntiVirService;Avira AntiVir Guard; D:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-08-12 185089] R2 Ati HotKey Poller;Ati HotKey Poller; D:\WINDOWS\system32\Ati2evxx.exe [2006-02-21 405504] R2 AVM IGD CTRL Service;AVM IGD CTRL Service; D:\Programme\FRITZ!DSL\IGDCTRL.EXE [2005-03-04 118784] R2 Irmon;Infrarotüberwachung; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R2 JavaQuickStarterService;Java Quick Starter; D:\Programme\Java\jre6\bin\jqs.exe [2009-07-25 153376] R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; D:\WINDOWS\System32\TUProgSt.exe [2009-06-21 604416] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R3 ServiceLayer;ServiceLayer; D:\Programme\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408] S2 Brother XP spl Service;BrSplService; D:\WINDOWS\system32\brsvc01a.exe [2002-04-12 57344] S2 gupdate;Google Update Service (gupdate); D:\Programme\Google\Update\GoogleUpdate.exe [2010-01-06 135664] S2 gusvc;Google Software Updater; D:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-22 183280] S3 aspnet_state;ASP.NET-Zustandsdienst; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632] S3 de_serv;AVM FRITZ!web Routing Service; D:\Programme\Gemeinsame Dateien\AVM\de_serv.exe [2005-03-04 315392] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104] S3 idsvc;Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664] S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; D:\Programme\Windows Media Player\WMPNetwk.exe [2006-10-24 920576] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096] -----------------EOF----------------- |
|
05.04.2010, 20:21
| #8 |
| | TR/Agent.ruo gefunden. Hallo, hier das Osamprotokoll: Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 21:17:37 on 05.04.2010 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Mozilla Corporation Firefox 3.5.9 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - D:\Programme\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - D:\Programme\Google\Update\GoogleUpdate.exe "Google Software Updater.job" - "Google" - D:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "ImageDrive.cpl" - "Ahead Software AG" - D:\WINDOWS\system32\ImageDrive.cpl "infocardcpl.cpl" - "Microsoft Corporation" - D:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - D:\WINDOWS\system32\javacpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - D:\PROGRA~2\Avira\ANTIVI~1\avconfig.cpl "NokiaConnectionManager" - "Nokia" - D:\PROGRA~2\Nokia\NOKIAP~1\CONNEC~1.CPL [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "AnyDVD" (AnyDVD) - "SlySoft, Inc." - D:\WINDOWS\System32\Drivers\AnyDVD.sys "avgio" (avgio) - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - D:\WINDOWS\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - D:\WINDOWS\System32\DRIVERS\avipbb.sys "Brother MFC Serial Port Interface WDM Driver" (BrSerIf) - "Brother Industries Ltd." - D:\WINDOWS\System32\Drivers\BrSerIf.sys "Brother MFC USB Serial WDM Driver" (BrUsbSer) - "Brother Industries Ltd." - D:\WINDOWS\System32\Drivers\BrUsbSer.sys "Brother USB Still Image driver" (BrScnUsb) - "Brother Industries Ltd." - D:\WINDOWS\System32\Drivers\BrScnUsb.sys "Changer" (Changer) - ? - D:\WINDOWS\system32\drivers\Changer.sys (File not found) "d3dstdy" (d3dstdy) - ? - D:\WINDOWS\system32\drivers\d3dstdy.sys (File not found) "ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - D:\WINDOWS\System32\Drivers\ElbyCDIO.sys "GMSIPCI" (GMSIPCI) - ? - F:\INSTALL\GMSIPCI.SYS (File not found) "i2omgmt" (i2omgmt) - ? - D:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "lbrtfdc" (lbrtfdc) - ? - D:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "NTACCESS" (NTACCESS) - ? - F:\NTACCESS.sys (File not found) "PCAMPR5 NDIS Protocol Driver" (PCAMPR5) - ? - D:\WINDOWS\system32\PCAMPR5.SYS (File not found) "PCIDump" (PCIDump) - ? - D:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - D:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - D:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - D:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - D:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "PLCMPR5 NDIS Protocol Driver" (PLCMPR5) - ? - D:\WINDOWS\system32\PLCMPR5.SYS (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - D:\WINDOWS\System32\Drivers\PxHelp20.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - D:\WINDOWS\System32\DRIVERS\ssmdrv.sys "TVICHW32" (TVICHW32) - "EnTech Taiwan" - D:\WINDOWS\system32\DRIVERS\TVICHW32.SYS "WDICA" (WDICA) - ? - D:\WINDOWS\system32\drivers\WDICA.sys (File not found) [Explorer] -----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - D:\WINDOWS\system32\Rundll32.exe D:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - D:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found) {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - D:\Programme\Microsoft Office\Office10\msohev.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - D:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - D:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\shlext.dll {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - D:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - D:\WINDOWS\system32\dfshim.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - D:\Programme\WinRAR\rarext.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab {166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - D:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? - (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}" - ? - (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "Exec" - ? - D:\Programme\WinSysClean 2008\UDManager\UDManager.exe (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - D:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - D:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini "FRITZ!DSL Startcenter.lnk" - "AVM Berlin" - D:\Programme\FRITZ!DSL\StCenter.exe (Shortcut exists | File exists) "Microsoft Office.lnk" - "Microsoft Corporation" - D:\Programme\Microsoft Office\Office10\OSA.EXE (Shortcut exists | File exists) -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - D:\Dokumente und Einstellungen\Rischke\Startmenü\Programme\Autostart\desktop.ini "FRITZ!DSL Protect.lnk" - "AVM Berlin" - D:\Programme\FRITZ!DSL\FwebProt.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "PC Suite Tray" - "Nokia" - "D:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "D:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "D:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" "ATICCC" - "ATI Technologies Inc." - "D:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay "avgnt" - "Avira GmbH" - "D:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min "CanonMyPrinter" - "CANON INC." - D:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon "CanonSolutionMenu" - "CANON INC." - D:\Programme\Canon\SolutionMenu\CNSLMAIN.exe /logon "IndexSearch" - "ScanSoft, Inc." - D:\Programme\ScanSoft\PaperPort\IndexSearch.exe "NeroCheck" - "Ahead Software Gmbh" - D:\WINDOWS\system32\NeroCheck.exe "PaperPort PTD" - "ScanSoft, Inc." - D:\Programme\ScanSoft\PaperPort\pptd40nt.exe "SSBkgdUpdate" - "Nuance Communications, Inc." - "D:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "D:\Programme\Java\jre6\bin\jusched.exe" "WrtMon.exe" - ? - D:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\sched.exe "AVM FRITZ!web Routing Service" (de_serv) - "AVM Berlin" - D:\Programme\Gemeinsame Dateien\AVM\de_serv.exe "AVM IGD CTRL Service" (AVM IGD CTRL Service) - "AVM Berlin" - D:\Programme\FRITZ!DSL\IGDCTRL.EXE "Google Software Updater" (gusvc) - "Google" - D:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe "Google Update Service (gupdate)" (gupdate) - "Google Inc." - D:\Programme\Google\Update\GoogleUpdate.exe "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\jqs.exe "ServiceLayer" (ServiceLayer) - "Nokia" - D:\Programme\PC Connectivity Solution\ServiceLayer.exe "TuneUp Program Statistics Service" (TuneUp.ProgramStatisticsSvc) - "TuneUp Software" - D:\WINDOWS\System32\TUProgSt.exe "Windows CardSpace" (idsvc) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "WgaLogon" - "Microsoft Corporation" - D:\WINDOWS\system32\WgaLogon.dll [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "Sarah NSP" - "AVM Berlin" - D:\Programme\FRITZ!DSL\sarah.dll -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )----- "SARAH LSP" - "AVM Berlin" - D:\Programme\FRITZ!DSL\sarah.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
05.04.2010, 20:27
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Agent.ruo gefunden. Hallo und Code:
ATTFilter [Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"d3dstdy" (d3dstdy) - ? - D:\WINDOWS\system32\drivers\d3dstdy.sys (File not found)
D:\WINDOWS\system32\drivers\d3dstdy.sys bei https://www.Virustotal.com auswerten. Bitte dann den Ergebnislink posten.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
05.04.2010, 20:47
| #10 |
| | TR/Agent.ruo gefunden. habe die Datei deaktiviert Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 21:46:27 on 05.04.2010 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Mozilla Corporation Firefox 3.5.9 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - D:\Programme\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - D:\Programme\Google\Update\GoogleUpdate.exe "Google Software Updater.job" - "Google" - D:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "ImageDrive.cpl" - "Ahead Software AG" - D:\WINDOWS\system32\ImageDrive.cpl "infocardcpl.cpl" - "Microsoft Corporation" - D:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - D:\WINDOWS\system32\javacpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - D:\PROGRA~2\Avira\ANTIVI~1\avconfig.cpl "NokiaConnectionManager" - "Nokia" - D:\PROGRA~2\Nokia\NOKIAP~1\CONNEC~1.CPL [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "AnyDVD" (AnyDVD) - "SlySoft, Inc." - D:\WINDOWS\System32\Drivers\AnyDVD.sys "avgio" (avgio) - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - D:\WINDOWS\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - D:\WINDOWS\System32\DRIVERS\avipbb.sys "Brother MFC Serial Port Interface WDM Driver" (BrSerIf) - "Brother Industries Ltd." - D:\WINDOWS\System32\Drivers\BrSerIf.sys "Brother MFC USB Serial WDM Driver" (BrUsbSer) - "Brother Industries Ltd." - D:\WINDOWS\System32\Drivers\BrUsbSer.sys "Brother USB Still Image driver" (BrScnUsb) - "Brother Industries Ltd." - D:\WINDOWS\System32\Drivers\BrScnUsb.sys "Changer" (Changer) - ? - D:\WINDOWS\system32\drivers\Changer.sys (File not found) "ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - D:\WINDOWS\System32\Drivers\ElbyCDIO.sys "GMSIPCI" (GMSIPCI) - ? - F:\INSTALL\GMSIPCI.SYS (File not found) "i2omgmt" (i2omgmt) - ? - D:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "lbrtfdc" (lbrtfdc) - ? - D:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "NTACCESS" (NTACCESS) - ? - F:\NTACCESS.sys (File not found) "PCAMPR5 NDIS Protocol Driver" (PCAMPR5) - ? - D:\WINDOWS\system32\PCAMPR5.SYS (File not found) "PCIDump" (PCIDump) - ? - D:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - D:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - D:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - D:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - D:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "PLCMPR5 NDIS Protocol Driver" (PLCMPR5) - ? - D:\WINDOWS\system32\PLCMPR5.SYS (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - D:\WINDOWS\System32\Drivers\PxHelp20.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - D:\WINDOWS\System32\DRIVERS\ssmdrv.sys "TVICHW32" (TVICHW32) - "EnTech Taiwan" - D:\WINDOWS\system32\DRIVERS\TVICHW32.SYS "WDICA" (WDICA) - ? - D:\WINDOWS\system32\drivers\WDICA.sys (File not found) [Explorer] -----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - D:\WINDOWS\system32\Rundll32.exe D:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - D:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found) {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - D:\WINDOWS\system32\mscoree.dll {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - D:\Programme\Microsoft Office\Office10\msohev.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - D:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - D:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\shlext.dll {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - D:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - D:\WINDOWS\system32\dfshim.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - D:\PROGRA~2\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - D:\Programme\WinRAR\rarext.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab {166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - D:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? - (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}" - ? - (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "Exec" - ? - D:\Programme\WinSysClean 2008\UDManager\UDManager.exe (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - D:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - D:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini "FRITZ!DSL Startcenter.lnk" - "AVM Berlin" - D:\Programme\FRITZ!DSL\StCenter.exe (Shortcut exists | File exists) "Microsoft Office.lnk" - "Microsoft Corporation" - D:\Programme\Microsoft Office\Office10\OSA.EXE (Shortcut exists | File exists) -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - D:\Dokumente und Einstellungen\Rischke\Startmenü\Programme\Autostart\desktop.ini "FRITZ!DSL Protect.lnk" - "AVM Berlin" - D:\Programme\FRITZ!DSL\FwebProt.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "PC Suite Tray" - "Nokia" - "D:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "D:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "D:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" "ATICCC" - "ATI Technologies Inc." - "D:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay "avgnt" - "Avira GmbH" - "D:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min "CanonMyPrinter" - "CANON INC." - D:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon "CanonSolutionMenu" - "CANON INC." - D:\Programme\Canon\SolutionMenu\CNSLMAIN.exe /logon "IndexSearch" - "ScanSoft, Inc." - D:\Programme\ScanSoft\PaperPort\IndexSearch.exe "NeroCheck" - "Ahead Software Gmbh" - D:\WINDOWS\system32\NeroCheck.exe "PaperPort PTD" - "ScanSoft, Inc." - D:\Programme\ScanSoft\PaperPort\pptd40nt.exe "SSBkgdUpdate" - "Nuance Communications, Inc." - "D:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "D:\Programme\Java\jre6\bin\jusched.exe" "WrtMon.exe" - ? - D:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - D:\Programme\Avira\AntiVir Desktop\sched.exe "AVM FRITZ!web Routing Service" (de_serv) - "AVM Berlin" - D:\Programme\Gemeinsame Dateien\AVM\de_serv.exe "AVM IGD CTRL Service" (AVM IGD CTRL Service) - "AVM Berlin" - D:\Programme\FRITZ!DSL\IGDCTRL.EXE "Google Software Updater" (gusvc) - "Google" - D:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe "Google Update Service (gupdate)" (gupdate) - "Google Inc." - D:\Programme\Google\Update\GoogleUpdate.exe "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - D:\Programme\Java\jre6\bin\jqs.exe "ServiceLayer" (ServiceLayer) - "Nokia" - D:\Programme\PC Connectivity Solution\ServiceLayer.exe "TuneUp Program Statistics Service" (TuneUp.ProgramStatisticsSvc) - "TuneUp Software" - D:\WINDOWS\System32\TUProgSt.exe "Windows CardSpace" (idsvc) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "WgaLogon" - "Microsoft Corporation" - D:\WINDOWS\system32\WgaLogon.dll [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "Sarah NSP" - "AVM Berlin" - D:\Programme\FRITZ!DSL\sarah.dll -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )----- "SARAH LSP" - "AVM Berlin" - D:\Programme\FRITZ!DSL\sarah.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
05.04.2010, 20:50
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Agent.ruo gefunden. Sieht ok aus. 1.) Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des Systems durch einen Wiederherstellungspunkt wahrscheinlich wieder eine Infektion nach sich ziehen würde. 2.) Mach bitte Kontrollscans (Vollscans) mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
05.04.2010, 20:55
| #12 | |
| | TR/Agent.ruo gefunden.Zitat:
 die Komplettscans mache ich morgen, heute zu spät. Nochmals Danke P.S. die Systemwiederherstellung auf Dauer deaktiviert lassen? Gruß Everell1 |
|
05.04.2010, 20:58
| #13 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Agent.ruo gefunden.Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.04.2010, 16:41
| #14 |
| | TR/Agent.ruo gefunden. Hier mal der erste Scann, hoffe es ist alles OK Gruß Everell1 Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Datenbank Version: 3960 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 06.04.2010 17:35:13 mbam-log-2010-04-06 (17-35-13).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 156351 Laufzeit: 19 Minute(n), 11 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
06.04.2010, 19:30
| #15 |
| | TR/Agent.ruo gefunden. Nun das Protokoll von Superantispyware. Scheinst hat er wieder was gefunden  SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 04/06/2010 at 08:25 PM Application Version : 4.35.1002 Core Rules Database Version : 4774 Trace Rules Database Version: 2586 Scan type : Complete Scan Total Scan Time : 02:36:07 Memory items scanned : 752 Memory threats detected : 0 Registry items scanned : 6097 Registry threats detected : 0 File items scanned : 178254 File threats detected : 1 Adware.Tracking Cookie D:\Dokumente und Einstellungen\xxxxxx\Cookies\xxxxxxx@doubleclick[1].txt |
|
| Themen zu TR/Agent.ruo gefunden. |
| avira, datei, euren, folge, folgende, formation, gefunde, information, meldung, programm, restore, system, system volume information, tr/agent.ruo, troja, trojan, unerwünschtes, unerwünschtes programm, virus, volume, _restore |
Linear-Darstellung
