| |
| |||||||
Log-Analyse und Auswertung: 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wiederWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.05.2010, 15:48
| #1 |
| | !['BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder - Standard](images/icons/icon1.gif){kind=icon} 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder Hallo, ich bin absoluter Neuling was Viren, Trojaner, etc. angeht. Sonst hatte ich immer jemanden der sich darum gekümmert hatte, doch nun muss ich mich selbst damit auseinandersetzen. Monatelang hatte ich keine Probleme, doch seit ungefähr einer Woche kommen andauern verschiedene Meldungen von Antivir. Ich kann mir nicht erklären woher und warum, aber es sind verschiedene. Die letzten waren Trojanische Pferde: z.B: 'C:\Users\Jolina\AppData\Local\Temp\HouseCall\log\1D6F1EF2-849E-493E-8B03-C8D018946D1B\backup\15' enthielt einen Virus oder unerwünschtes Programm 'TR/PCK.Tdss.Z.4410' [trojan] 'C:\Users\Jolina\AppData\Local\Temp\gmfrxpgv.exe' wurde ein Virus oder unerwünschtes Programm 'TR/Dldr.Agent.dnms' [trojan] aber auch das wurde gefunden: 'C:\Users\Jolina\AppData\Local\Temp\C1CE.tmp' wurde ein Virus oder unerwünschtes Programm 'BDS/Sinowal.ilw' [backdoor] C:\Users\Jolina\AppData\Local\Temp\B982.tmp' wurde ein Virus oder unerwünschtes Programm 'BDS/Sinowal.ilx' [backdoor] Ich habe versucht mich selbst schlau zu machen, aber ich verstehe irgendwie nur Bahnhof und habe jetzt als letzte Hoffnung diese Seite hier, denn ich bekomme diese Viren und Pferde nicht mehr los. Jeden Tag kommen wieder zig neue Meldungen und ich habe Angst dass ich meinen Rechner komplett neu machen muss. Ich hab versucht mich an alles zu halten was hier als Regeln aufgestellt wurde und hab die verschiedenen Programme installiert. Den CCleaner hab ich nach Anleitung durchlaufen lassen, bin ich auch gut mit zurecht gekommen. Bei Malwarebytes ist das rausgekommen: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4064 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 04.05.2010 16:11:06 mbam-log-2010-05-04 (16-11-06).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 117778 Laufzeit: 8 Minute(n), 9 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 1 Infizierte Registrierungsschlüssel: 4 Infizierte Registrierungswerte: 2 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 5 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\Users\Jolina\AppData\Local\Temp\sshnas21.dll (Trojan.Downloader) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\m5t8ql3yw3 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\canaveral (Trojan.Downloader) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Jolina\AppData\Local\Temp\Qwl.exe (Trojan.FakeAlert) -> Delete on reboot. C:\Users\Jolina\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\Users\Jolina\AppData\Local\Temp\sshnas21.dll (Trojan.Downloader) -> Delete on reboot. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. und bei RSIT hab ich nur den Bericht bekommen: Logfile of random's system information tool 1.06 (written by random/random) Run by Jolina at 2010-05-04 16:15:59 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 401 GB (68%) free of 590 GB Total RAM: 2815 MB (70% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:16:05, on 04.05.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18904) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Windows\System32\rundll32.exe C:\Windows\PixArt\Pac207\Monitor.exe C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Jolina\Programme\sicherheit\RSIT.exe C:\Program Files\trend micro\Jolina.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.medion.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.medion.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Bandoo IE Plugin - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - (no file) O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe O4 - HKLM\..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Google Update] "C:\Users\Jolina\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office14\EXCEL.EXE/3000 O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MI1933~1\Office14\ONBttnIE.dll/105 O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing) O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing) O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU) O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU) O13 - Gopher Prefix: O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe -- End of file - 6538 bytes ======Scheduled tasks folder====== C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2527020731-4255335547-3161248611-1000Core.job C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2527020731-4255335547-3161248611-1000UA.job C:\Windows\tasks\User_Feed_Synchronization-{A0597C29-F6B0-4800-9511-ED89D5D8DD61}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-01 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184] "RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-02-03 6724128] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2009-02-03 1833504] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-09-17 13580832] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-09-17 92704] "Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2007-12-10 323584] "PAC207_Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2007-12-10 323584] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768] "SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840] "Google Update"=C:\Users\Jolina\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-16 135664] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher] C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe [2008-10-14 20480] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SAFEOEM HotKeys] C:\Program Files\Steganos Safe OEM\SteganosHotKeyService.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - C:\Windows\System32\WScript.exe "%1" %* ======List of files/folders created in the last 1 months====== 2010-05-04 16:05:40 ----D---- C:\rsit 2010-05-04 16:05:40 ----D---- C:\Program Files\trend micro 2010-05-04 15:58:00 ----D---- C:\Users\Jolina\AppData\Roaming\Malwarebytes 2010-05-04 15:57:48 ----D---- C:\ProgramData\Malwarebytes 2010-05-04 15:57:47 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-05-01 19:40:27 ----D---- C:\ProgramData\Sun 2010-05-01 19:40:26 ----D---- C:\Program Files\Common Files\Java 2010-05-01 19:39:45 ----A---- C:\Windows\system32\javaws.exe 2010-05-01 19:39:45 ----A---- C:\Windows\system32\javaw.exe 2010-05-01 19:39:45 ----A---- C:\Windows\system32\java.exe 2010-05-01 19:39:45 ----A---- C:\Windows\system32\deployJava1.dll 2010-05-01 19:39:33 ----D---- C:\Program Files\Java 2010-05-01 14:13:10 ----D---- C:\Users\Jolina\AppData\Roaming\E83FD5FEBE87DA680D55851474DAFA45 2010-04-14 08:18:46 ----A---- C:\Windows\system32\ntoskrnl.exe 2010-04-14 08:18:46 ----A---- C:\Windows\system32\ntkrnlpa.exe 2010-04-14 08:18:34 ----A---- C:\Windows\system32\vbscript.dll 2010-04-14 08:18:31 ----A---- C:\Windows\system32\iphlpsvc.dll 2010-04-14 08:18:03 ----A---- C:\Windows\system32\wintrust.dll 2010-04-14 08:14:59 ----A---- C:\Windows\system32\cabview.dll ======List of files/folders modified in the last 1 months====== 2010-05-04 16:16:01 ----D---- C:\Windows\Temp 2010-05-04 16:13:13 ----D---- C:\Windows 2010-05-04 16:11:06 ----D---- C:\Windows\Tasks 2010-05-04 16:11:04 ----D---- C:\Windows\prefetch 2010-05-04 16:05:40 ----RD---- C:\Program Files 2010-05-04 15:58:11 ----D---- C:\Windows\system32\Tasks 2010-05-04 15:57:49 ----D---- C:\Windows\system32\drivers 2010-05-04 15:57:48 ----HD---- C:\ProgramData 2010-05-04 15:03:03 ----D---- C:\Windows\System32 2010-05-04 15:03:03 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-05-04 15:03:02 ----D---- C:\Windows\inf 2010-05-03 09:08:01 ----SHD---- C:\System Volume Information 2010-05-01 19:56:07 ----SD---- C:\Windows\Downloaded Program Files 2010-05-01 19:40:26 ----SHD---- C:\Windows\Installer 2010-05-01 19:40:26 ----D---- C:\Program Files\Common Files 2010-05-01 19:18:37 ----D---- C:\Windows\system32\catroot2 2010-05-01 17:21:21 ----HD---- C:\Program Files\InstallShield Installation Information 2010-04-30 12:16:04 ----D---- C:\Users\Jolina\AppData\Roaming\Azureus 2010-04-29 13:36:27 ----D---- C:\Users\Jolina\AppData\Roaming\vlc 2010-04-28 20:15:47 ----RSD---- C:\Windows\Fonts 2010-04-28 12:17:29 ----D---- C:\Windows\winsxs 2010-04-28 10:08:12 ----D---- C:\Windows\system32\catroot 2010-04-19 08:47:19 ----D---- C:\Windows\Debug 2010-04-15 08:00:44 ----D---- C:\Program Files\Windows Mail 2010-04-08 16:46:25 ----D---- C:\Program Files\DVDVideoSoft 2010-04-08 16:45:19 ----D---- C:\Program Files\Common Files\DVDVideoSoft 2010-04-06 19:52:54 ----A---- C:\Windows\system32\mrt.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-07 56816] R2 irda;IrDA-Protokoll; C:\Windows\system32\DRIVERS\irda.sys [2008-01-21 95744] R3 Afc;PPdus ASPI Shell; C:\Windows\system32\drivers\Afc.sys [2005-02-23 11776] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-02-03 2320480] R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2008-08-01 1052704] R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2008-08-05 44576] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-09-17 7379872] R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2008-08-25 15872] R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264] R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632] S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016] S3 PAC207;Trust 100K Series Webcam; C:\Windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\Windows\system32\DRIVERS\ss_bus.sys [2007-05-02 83592] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\Windows\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\Windows\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704] S3 STIrUsb;SigmaTel USB-IrDA-Dongle; C:\Windows\system32\DRIVERS\irstusb.sys [2008-01-21 30208] S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089] R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2008-01-21 21504] R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-09-17 196608] R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920] R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-12-01 66872] R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2009-12-01 107832] S3 aspnet_state;ASP.NET-Zustandsdienst; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504] S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-09-18 182768] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632] S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704] -----------------EOF----------------- Ich hoffe, dass das alles ausreicht damit Ihr mir helfen könnt. Ich möchte versuchen das Problem zu lösen ohne dass ich meinen Rechner komplett neu machen muss. Vor allem hab ich Angst weil ich sonst immer Online Banking nutze und ich das nun nicht mehr machen soll, laut dem was ich im Netz gelesen habe. Und muss ich jetzt sämtliche Passwörter erneuern ??? Ich danke euch schonmal im voraus und drück ganz doll die Daumen dass einer von euch mir helfen kann..... ganz liebe Grüße dreamingsoul |
|
05.05.2010, 09:55
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder Hallo und
__________________ Zitat:
Bitte nen Vollscan mit Malwarebytes machen und Log posten. Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
05.05.2010, 11:20
| #3 |
| | 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder Hallo,
__________________hab ich gemacht... rausgekommen ist: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4064 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 05.05.2010 12:14:43 mbam-log-2010-05-05 (12-14-43).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 1 Laufzeit: 34 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) und: OTL logfile created on: 05.05.2010 12:11:21 - Run 1 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Jolina\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 65,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 576,15 Gb Total Space | 395,44 Gb Free Space | 68,63% Space Free | Partition Type: NTFS Drive D: | 20,01 Gb Total Space | 10,45 Gb Free Space | 52,24% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: JOLINA-PC Current User Name: Jolina Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\Jolina\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Alice Software\AliceEinwahl.exe (Hansenet) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation) ========== Modules (SafeList) ========== MOD - C:\Users\Jolina\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation) DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (PAC207) -- C:\Windows\System32\drivers\PFC027.SYS (PixArt Imaging Inc.) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (STIrUsb) -- C:\Windows\System32\drivers\irstusb.sys (SigmaTel, Inc.) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (ss_mdm) -- C:\Windows\System32\drivers\ss_mdm.sys (MCCI Corporation) DRV - (ss_mdfl) -- C:\Windows\System32\drivers\ss_mdfl.sys (MCCI Corporation) DRV - (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM) -- C:\Windows\System32\drivers\ss_bus.sys (MCCI Corporation) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (Afc) -- C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.medion.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.medion.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://google.de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.01 19:29:15 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.01 19:39:45 | 000,000,000 | ---D | M] [2009.09.25 17:31:29 | 000,000,000 | ---D | M] -- C:\Users\Jolina\AppData\Roaming\mozilla\Extensions [2010.05.01 19:41:36 | 000,000,000 | ---D | M] -- C:\Users\Jolina\AppData\Roaming\mozilla\Firefox\Profiles\cbh1qyhw.default\extensions [2010.03.22 21:00:33 | 000,002,236 | ---- | M] () -- C:\Users\Jolina\AppData\Roaming\Mozilla\FireFox\Profiles\cbh1qyhw.default\searchplugins\askcom.xml [2010.03.22 18:33:26 | 000,000,881 | ---- | M] () -- C:\Users\Jolina\AppData\Roaming\Mozilla\FireFox\Profiles\cbh1qyhw.default\searchplugins\conduit.xml [2010.05.01 19:39:47 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.05.01 19:39:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.05.01 19:39:35 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.04.01 19:29:13 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.04.01 19:29:13 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.04.01 19:29:13 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2009.07.23 04:00:42 | 000,000,832 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\WebSearch.xml [2010.04.01 19:29:13 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.04.01 19:29:13 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (no name) - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [PAC207_Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Jolina\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Jolina\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.05.05 12:08:24 | 000,000,000 | ---D | C] -- C:\Users\Jolina\Documents\Downloads [2010.05.04 16:05:40 | 000,000,000 | ---D | C] -- C:\Programme\trend micro [2010.05.04 16:05:40 | 000,000,000 | ---D | C] -- C:\rsit [2010.05.04 15:58:00 | 000,000,000 | ---D | C] -- C:\Users\Jolina\AppData\Roaming\Malwarebytes [2010.05.04 15:57:49 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.05.04 15:57:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.05.04 15:57:47 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.05.04 15:57:47 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.05.01 19:40:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.05.01 19:40:26 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2010.05.01 19:39:45 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2010.05.01 19:39:45 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.05.01 19:39:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.05.01 19:39:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.05.01 19:39:33 | 000,000,000 | ---D | C] -- C:\Programme\Java [2010.04.14 08:18:46 | 003,600,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2010.04.14 08:18:46 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2010.04.14 08:18:34 | 000,420,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010.04.14 08:18:33 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm [2010.04.14 08:18:33 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm [2010.04.07 22:11:04 | 000,000,000 | ---D | C] -- C:\Users\Jolina\Documents\DVDVideoSoft ========== Files - Modified Within 30 Days ========== [2010.05.05 12:13:23 | 002,883,584 | -HS- | M] () -- C:\Users\Jolina\NTUSER.DAT [2010.05.05 12:01:55 | 000,000,428 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{A0597C29-F6B0-4800-9511-ED89D5D8DD61}.job [2010.05.05 11:21:16 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2527020731-4255335547-3161248611-1000UA.job [2010.05.05 10:57:05 | 001,447,804 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.05.05 10:57:05 | 000,628,672 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.05.05 10:57:05 | 000,595,748 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.05.05 10:57:05 | 000,127,400 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.05.05 10:57:05 | 000,105,078 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.05.05 10:49:41 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.05.05 10:49:41 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.05.05 10:49:37 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.05.05 10:49:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.05.05 10:46:49 | 000,524,288 | -HS- | M] () -- C:\Users\Jolina\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.05.05 10:46:49 | 000,065,536 | -HS- | M] () -- C:\Users\Jolina\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.05.05 10:46:32 | 003,193,141 | -H-- | M] () -- C:\Users\Jolina\AppData\Local\IconCache.db [2010.05.03 13:21:00 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2527020731-4255335547-3161248611-1000Core.job [2010.05.01 19:39:35 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2010.05.01 19:39:35 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2010.05.01 19:39:35 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2010.05.01 19:39:34 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2010.05.01 18:17:21 | 000,000,036 | ---- | M] () -- C:\Users\Jolina\AppData\Local\housecall.guid.cache [2010.04.30 12:10:57 | 000,025,602 | ---- | M] () -- C:\Users\Jolina\Documents\Finanzplan.ods [2010.04.29 13:28:09 | 000,122,368 | ---- | M] () -- C:\Users\Jolina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.04.29 09:54:01 | 000,410,024 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.04.13 16:34:30 | 000,000,008 | ---- | M] () -- C:\Users\Jolina\AppData\Roaming\jdzarn.dat ========== Files Created - No Company Name ========== [2010.05.01 18:17:21 | 000,000,036 | ---- | C] () -- C:\Users\Jolina\AppData\Local\housecall.guid.cache [2010.04.13 16:34:30 | 000,000,008 | ---- | C] () -- C:\Users\Jolina\AppData\Roaming\jdzarn.dat [2010.01.04 20:06:57 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI [2009.12.01 17:10:20 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2009.10.30 13:45:44 | 000,000,399 | ---- | C] () -- C:\Windows\System32\Remover.ini [2009.09.24 08:46:02 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.08.03 01:21:54 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2009.08.03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2009.08.03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2009.08.03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2009.08.03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2009.08.03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2009.08.03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2009.08.03 01:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2009.08.03 01:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2009.08.03 01:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 10:27:46 | 000,000,566 | ---- | C] () -- C:\Windows\System32\SP207.ini [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2002.03.17 02:00:00 | 000,007,420 | ---- | C] () -- C:\Windows\UA000096.DLL < End of report > OTL Extras logfile created on: 05.05.2010 12:11:21 - Run 1 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Jolina\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 65,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): ?:\pagefile.sys %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 576,15 Gb Total Space | 395,44 Gb Free Space | 68,63% Space Free | Partition Type: NTFS Drive D: | 20,01 Gb Total Space | 10,45 Gb Free Space | 52,24% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: JOLINA-PC Current User Name: Jolina Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- C:\Users\Jolina\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0EE1456D-0727-4ACF-B0F7-A918C7975C30}" = lport=445 | protocol=6 | dir=in | app=system | "{11B5C367-F616-48EC-A117-20FAF3986CFE}" = rport=137 | protocol=17 | dir=out | app=system | "{2CE54BC1-7834-448C-A234-88A14CF37AC3}" = rport=445 | protocol=6 | dir=out | app=system | "{340524C3-182D-44DF-BFAA-ED47BE3C9522}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{4604BBB9-72EF-440D-A35B-097E64347C96}" = lport=138 | protocol=17 | dir=in | app=system | "{67C1ADDF-57C4-484A-978F-4C14ACC08A04}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{718CB512-DA4E-4B07-B7EF-936823EF709B}" = lport=139 | protocol=6 | dir=in | app=system | "{8865B761-7337-4335-ACD8-81DC10C24F2C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{A830298D-1A82-46F7-AF19-B7EEAA9B2FFA}" = lport=137 | protocol=17 | dir=in | app=system | "{AED630EB-AD09-43AC-9F1A-54CB20E43392}" = rport=139 | protocol=6 | dir=out | app=system | "{BC215AAA-57F8-46C5-A3DF-CC5C04F39794}" = rport=138 | protocol=17 | dir=out | app=system | "{BC7A0006-967E-4BCA-93BF-4D0248070836}" = lport=2869 | protocol=6 | dir=in | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{01092D5B-382E-42AE-AFF3-A8205CAF22A4}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{12280C99-CAA8-4FC7-90FF-E462C49155E1}" = protocol=6 | dir=in | app=c:\windows\system32\lxcccoms.exe | "{16CE0C36-6AB5-426C-BB0D-F1EA0A191EA2}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | "{3605A487-9887-49EA-A3A6-305763140A16}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | "{4A7729E7-73D1-4B7A-A6AB-8D1E9EEC31EC}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{4EF8CC92-F39A-4737-BA32-E728E906B1E1}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{4FEBA3D5-2773-4678-99B8-9623AFC2A9FA}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | "{85F00BE1-9AF5-4550-83D8-40866A872238}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | "{90DA0B4F-DBD2-4532-A063-ED1B2CCD272D}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | "{9438C76D-C9A8-41E7-9779-59678DB67835}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | "{A2F83757-59C5-4A64-9054-B02B568863C1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{AF158972-8B03-45D7-A4D6-60A0B06C7E83}" = protocol=17 | dir=in | app=c:\windows\system32\lxcccoms.exe | "{B7DF7A66-7625-4028-A5D9-71C17B3798D1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{BC39919C-7859-47DA-BD80-20C036A14104}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{DC3E8770-0337-42E4-974F-2FB1A8381195}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{DC8F5868-862A-4BB2-9B19-50E8C8AAF2AA}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | "TCP Query User{3DEF1035-952B-47B2-B0E2-2A84D0082780}C:\program files\azureus\azureus.exe" = protocol=6 | dir=in | app=c:\program files\azureus\azureus.exe | "TCP Query User{40E16810-35DF-4431-A972-EAC6FF3361E8}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=6 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe | "TCP Query User{5253EE13-9701-4032-B396-5D39F0D14FDC}C:\users\jolina\documents\azureus downloads\call of duty 1\call of duty\call of duty 1\codmp.exe" = protocol=6 | dir=in | app=c:\users\jolina\documents\azureus downloads\call of duty 1\call of duty\call of duty 1\codmp.exe | "TCP Query User{7AFC300C-5CDC-4833-A8EA-FEB81FAA6309}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "TCP Query User{8ABD12BB-BE14-48DF-8E99-C6F24E7BD247}C:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp spiel.exe" = protocol=6 | dir=in | app=c:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp spiel.exe | "TCP Query User{9ED368FF-AB2F-4DB8-9470-4577C5500F52}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "TCP Query User{F7D38DF1-85B7-467E-B2D6-6557AEFE581B}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "TCP Query User{FD2B49B6-279A-4F9E-B3C8-0533AD507EFE}C:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp.exe" = protocol=6 | dir=in | app=c:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp.exe | "UDP Query User{1BB0DE61-1A20-428B-9AAF-B1F2E7D2320C}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | "UDP Query User{A123C3DF-2ED2-43D6-8D35-00FF5096BD62}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "UDP Query User{B3CF097C-A05D-4922-BE81-45E391D174D6}C:\program files\azureus\azureus.exe" = protocol=17 | dir=in | app=c:\program files\azureus\azureus.exe | "UDP Query User{C74C79EB-12E2-4A69-880E-D9985310AADC}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "UDP Query User{D36F1429-F5D7-4D91-B16D-6ABDED53D829}C:\users\jolina\documents\azureus downloads\call of duty 1\call of duty\call of duty 1\codmp.exe" = protocol=17 | dir=in | app=c:\users\jolina\documents\azureus downloads\call of duty 1\call of duty\call of duty 1\codmp.exe | "UDP Query User{DA5BDF07-B1AD-43AD-AA74-C8E0EBD3DC2F}C:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp spiel.exe" = protocol=17 | dir=in | app=c:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp spiel.exe | "UDP Query User{E7599EFE-3FE1-439F-A047-0D858ADDC899}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=17 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe | "UDP Query User{F97E1C4C-4EFB-4C01-92FD-DE515FBE74C6}C:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp.exe" = protocol=17 | dir=in | app=c:\users\jolina\desktop\call of duty 1\call of duty\call of duty 1\codmp.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20 "{2CA6B50B-EA91-43AF-9347-6E85F16D0329}" = BS Contact "{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component "{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup "{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger "{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec "{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player "{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}" = Microsoft SQL Server 2005 Compact Edition [DEU] "{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3 "{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX "{C679F9B9-C65D-4C65-BD6C-BF90B859E281}" = Trust 100K Series Webcam "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime "{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer "{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials "{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "Alice Software" = Alice Software 4.10.0 "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "Azureus" = Azureus "CCleaner" = CCleaner (remove only) "DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters "EADM" = EA Download Manager "Free Audio Dub_is1" = Free Audio Dub version 1.5 "Free Video Dub_is1" = Free Video Dub version 1.6 "HijackThis" = HijackThis 2.0.2 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9) "NVIDIA Drivers" = NVIDIA Drivers "Picasa2" = Picasa 2 "PunkBusterSvc" = PunkBuster Services "SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set "Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software "SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software "SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software "Uninstall_is1" = Uninstall 1.0.0.1 "VLC media player" = VLC media player 1.0.2 "Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner "WinLiveSuite_Wave3" = Windows Live Essentials "WinRAR archiver" = WinRAR "Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Google Chrome" = Google Chrome ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 04.05.2010 09:58:56 | Computer Name = Jolina-PC | Source = Windows Search Service | ID = 3013 Description = Error - 04.05.2010 09:58:57 | Computer Name = Jolina-PC | Source = Windows Search Service | ID = 3013 Description = Error - 04.05.2010 09:58:57 | Computer Name = Jolina-PC | Source = Windows Search Service | ID = 3013 Description = Error - 04.05.2010 10:14:56 | Computer Name = Jolina-PC | Source = WinMgmt | ID = 10 Description = Error - 04.05.2010 10:16:13 | Computer Name = Jolina-PC | Source = Windows Search Service | ID = 3024 Description = Error - 05.05.2010 02:31:08 | Computer Name = Jolina-PC | Source = WinMgmt | ID = 10 Description = Error - 05.05.2010 03:21:17 | Computer Name = Jolina-PC | Source = Google Update | ID = 20 Description = Error - 05.05.2010 04:21:16 | Computer Name = Jolina-PC | Source = Google Update | ID = 20 Description = Error - 05.05.2010 04:51:16 | Computer Name = Jolina-PC | Source = WinMgmt | ID = 10 Description = Error - 05.05.2010 05:21:16 | Computer Name = Jolina-PC | Source = Google Update | ID = 20 Description = [ System Events ] Error - 08.03.2010 13:05:06 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 09.03.2010 03:47:51 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 09.03.2010 13:18:40 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 09.03.2010 13:18:41 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 10.03.2010 03:38:34 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 10.03.2010 03:38:35 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 10.03.2010 03:44:28 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 10.03.2010 03:44:29 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 10.03.2010 07:19:52 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. Error - 10.03.2010 07:19:53 | Computer Name = Jolina-PC | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{215D7E19-5486-4FFC-A735-040C29C4383A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. < End of report > vielen lieben Dank für´s nachschauen. Gruß dreamingsoul |
|
05.05.2010, 11:29
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wiederZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
05.05.2010, 16:22
| #5 |
| | 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4064 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18904 05.05.2010 17:20:37 mbam-log-2010-05-05 (17-20-37).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 233267 Laufzeit: 1 Stunde(n), 0 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
05.05.2010, 18:32
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
[2010.04.13 16:34:30 | 000,000,008 | ---- | M] () -- C:\Users\Jolina\AppData\Roaming\jdzarn.dat
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________ --> 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder |
|
05.05.2010, 20:39
| #7 |
| | 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder All processes killed ========== OTL ========== C:\Users\Jolina\AppData\Roaming\jdzarn.dat moved successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 83 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Jolina ->Temp folder emptied: 78863228 bytes ->Temporary Internet Files folder emptied: 7970984 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 39804379 bytes ->Google Chrome cache emptied: 59721133 bytes ->Flash cache emptied: 10424 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 2830 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 178,00 mb OTL by OldTimer - Version 3.2.4.1 log created on 05052010_213454 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
06.05.2010, 08:41
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder Ok, weiter gehts mit CF: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu 'BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder |
| antivir guard, avg, avgntflt.sys, avira, backdoor, bandoo, bho, browser, desktop, device driver, ebay, error, excel, fontcache, hdaudio.sys, hijack, hijackthis, hkus\s-1-5-18, home, home premium, hotkeys, installation, local\temp, notepad.exe, nvlddmkm.sys, picasa, plug-in, programdata, programm, realtek, registry, rundll, sicherheit, software, svchost.exe, system, trojan.downloader, trojaner, trojanische pferde, trojanisches pferd, viren, virenbefall, virus, warum, wscript.exe |
!['BDS/Sinowal.ilw' [backdoor] und trojanische Pferde kommen immer wieder](iconimages/log-analyse-auswertung/bds-sinowal-ilw-backdoor-trojanische-pferde-kommen-immer_ltr.gif)
Linear-Darstellung
